Description

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for. to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read. Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T00:17:31.917Z",
  "pubdate": "2026-08-13T00:17:31.917Z",
  "executiveSummary": "PDF::WebKit versions through 1.2 for Perl suffer from an OS command injection vulnerability. The flaw exists in the to_pdf, to_file, and _style_tag_for functions, which improperly process output paths and stylesheet paths using Perl's insecure 2-arg open() mechanism via the diamond operator and local @ARGV assignment. This vulnerability allows an attacker capable of supplying untrusted input to the vulnerable functions to execute arbitrary OS commands under the privileges of the running process UID. Depending on the specific injection vector utilized, attackers can achieve arbitrary command execution, return command output in place of generated PDFs, or truncate arbitrary files via redirection characters. Exploitation requires a caller to forward untrusted input as the output path or within the stylesheets list. The risk implications are severe, potentially leading to total system compromise or unauthorized data manipulation depending on the application context and process privileges.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure use of Perl's 2-arg open() function through the diamond operator interacting with modified @ARGV array assignments. Specifically, the vulnerable components include the to_pdf, to_file, and _style_tag_for functions within PDF::WebKit versions through 1.2. In _style_tag_for, each entry of the stylesheets list is assigned to a local @ARGV array and read using the diamond operator, which triggers Perl's 2-arg open() behavior. Similarly, to_pdf and its wrapper to_file pass the generated PDF output path through a mechanism that subsequently reads the file back from its path argument using the same dangerous pattern.\nPerl's 2-arg open() interprets specific leading or trailing characters within string arguments as shell commands or file redirection directives rather than literal file paths. If a path value begins or ends with a pipe character ('| cmd' or 'cmd |'), the string is executed as a system command rather than opened as a file handle. Furthermore, if a value begins with redirection characters such as '> path' or '>> path', the specified path is opened for writing or appending, leading to file truncation or arbitrary file write conditions.\nThe attack flow proceeds as follows: An external caller supplies untrusted input that flows into either the output path parameter or an entry within the stylesheets list. When the application processes an HTML source containing malicious stylesheet entries or invokes PDF generation with a crafted output path, the vulnerable function assigns the untrusted string to @ARGV. The subsequent read operation executes the 2-arg open() evaluation. If the attacker employs the 'cmd |' injection vector, the command executes and its standard output is captured and returned in place of the expected PDF document. If the attacker utilizes redirection payloads, named files on the filesystem are truncated or modified.\nPrerequisites for exploitation include an application architecture that forwards untrusted, attacker-controlled input directly into the output path of to_pdf/to_file or into the stylesheets array of _style_tag_for. Stylesheets may only be added to an HTML source, meaning URL or file sources expose only the output path vector. Execution occurs under the security context and UID of the process running the Perl application."
}