pdf-image (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package pdf-image, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (3)

• CVE-2018-3757 — CVSS 9.8 (critical): Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.
• CVE-2020-8132 — CVSS 9.8 (critical): Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is…
• CVE-2026-26830 — CVSS 9.8 (critical): pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and…