mitre / mitre/secure-coding-case-studies

Proposal: Command Injection Case Study for CVE-2026-26830 (pdf-image npm package)

Open
#68 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
11
Forks
45
PR merge metrics
No merged PRs in 30d

Description

We are proposing to write a case study on the command injection vulnerability in the pdf-image npm package (CVE-2026-26830).

Description: If an attacker inputs their own file path into PDFImage and the input contains a command, the command will execute on the host system’s shell. This vulnerability stems from the constructGetInfoCommand() and constructConvertCommandForPage() functions calling child_process.exec() using the attacker-controlled input.

Proposed vulnerability: CVE-2026-26830
Software: pdf-image npm package
Primary weakness: CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
CVSS: 9.8 (Critical)

Group (24) Members:

  1. Thi Ley
  2. Cassandra Nguyen
  3. Loc Nguyen

References:

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Review existing case studies in the repository for the expected structure, then read the CVE-2026-26830 advisory and the referenced pdf-image package. Focus on constructGetInfoCommand() and constructConvertCommandForPage() and document how attacker-controlled input reaches child_process.exec(). Done means a complete case study explaining the command-injection weakness and its security implications.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
documentation, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.