CVE-2018-3757: Command Injection in pdf-image
Summary
CVE-2018-3757: Command Injection in pdf-image. Affects pdf-image versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pdf-image is an npm package that allows users to convert PDF files into images. It is commonly used in applications that require PDF manipulation or image extraction from PDFs. The package provides a convenient way to convert PDF files to various image formats. However, versions prior to 2.0.0 are vulnerable to command injection.
Vulnerability Detail
The vulnerability in pdf-image arises when the attacker gains control over the pdfFilePath variable passed into the package. This allows them to inject arbitrary commands, leading to command execution on the host system. The impact of this vulnerability is critical, as an attacker can execute arbitrary commands with the privileges of the user running the application. This can result in unauthorized access, data leakage, or even complete compromise of the host system.
How To Fix
Latest published version: 2.0.0 as of 22 Oct 2026
npm install pdf-image@2.0.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in pdf-image allows for command injection, which can lead to unauthorized access and compromise of the host system. It is crucial to update the package to version 2.0.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pdf-image →
FAQ
pdf-image is an npm package used for converting PDF files to images.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a host system.
An attacker can exploit this vulnerability by controlling the pdfFilePath variable passed into pdf-image and injecting malicious commands.
The consequences of this vulnerability include unauthorized access, data leakage, and potential compromise of the host system.
Updating the pdf-image package to version 2.0.0 or later will protect your application from this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pdf-image.
