Description

PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection. Any caller that renders untrusted HTML lets the document choose the renderer's options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T00:17:31.763Z",
  "pubdate": "2026-08-13T00:17:31.763Z",
  "executiveSummary": "PDF::WebKit versions through 1.2 for Perl suffer from an argument injection vulnerability caused by improper handling of HTML meta tags. The vulnerability stems from the module extracting configuration parameters directly from document head elements and translating them into command-line options for the underlying wkhtmltopdf binary without validation against an allow list. This flaw allows an untrusted HTML document to arbitrarily override application-defined rendering options and supply custom command-line switches. The impact includes severe security implications such as the reading of arbitrary local files into the generated PDF output or writing data to controlled file paths. Exploitation requires an attacker to supply or render untrusted HTML content via string or file sources under conditions where XML::LibXML is not installed or when the parser processes the document head. No authentication or elevated privileges are required beyond the ability to supply or influence the rendered HTML payload. Risk implications remain high for applications that process user-supplied documents, as malicious inputs can compromise data confidentiality and integrity through unauthorized file system access.",
  "technicalDetails": "The vulnerability resides in the PDF::WebKit Perl module, specifically affecting versions through 1.2. The root cause is an insecure design pattern within the constructor and option merging logic. When processing an HTML string or file source, the module invokes the internal function _pdf_webkit_meta_tags to parse the document head for any <meta name=\"pdf-webkit-KEY\" content=\"VALUE\"> elements. Each discovered element is translated directly into a command-line option for the wkhtmltopdf rendering engine. The KEY component is normalized to match the pattern --[a-z0-9-]+, but it lacks validation against a secure allow list of permitted parameters. Concurrently, the VALUE component is passed through without sanitization or modification, with a specific condition where a VALUE of \"yes\" emits the option as a bare flag. During the BUILD phase, these meta-derived options are merged last, giving them precedence over both module defaults and explicitly defined options passed to the new constructor.\nBecause wkhtmltopdf is executed with an argument list rather than a shell command, the resulting flaw manifests as argument injection rather than traditional shell command injection. Despite the absence of shell execution, this mechanism successfully reaches sensitive switches such as --enable-local-file-access and --cookie-jar. The attack flow begins when an application processes an untrusted HTML document containing maliciously crafted meta tags. Because URL sources are not scanned and the vulnerability depends on the presence or absence of recommended dependencies—specifically being skipped only when XML::LibXML is installed—environments lacking XML::LibXML are directly exposed. Upon rendering, the malicious HTML document dictates the renderer's configuration options. Post-exploitation impact includes the potential exposure of sensitive local files embedded into the resulting PDF payload or unauthorized file system write operations dictated by the attacker's supplied parameters."
}