{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "last_affected": "1.2"
              },
              {
                "fixed": "1.2"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "DESCRIPTION"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "23ccc37d77604403c42dfba201d38b7366275955"
            }
          ],
          "repo": "https://github.com/kingpong/perl-pdf-webkit",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "CPANSec",
    "cwe_ids": [
      "CWE-73",
      "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17431.json"
  },
  "details": "PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.\n\nto_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe (\"| cmd\", \"cmd |\") is run as a command rather than opened as a file, and one that begins with a redirect (\"\u003e path\", \"\u003e\u003e path\") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.\n\nAny caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the \"cmd |\" form the command's output is returned in place of the PDF, and with the \"\u003e path\" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.",
  "id": "CVE-2026-17431",
  "modified": "2026-08-15T11:31:09.353533075Z",
  "published": "2026-08-12T23:12:57.958Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/13/3"
    },
    {
      "type": "WEB",
      "url": "https://cpan.org/modules"
    },
    {
      "type": "WEB",
      "url": "https://wkhtmltopdf.org/status.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17431.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17431"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/kingpong/perl-PDF-WebKit/issues/8"
    },
    {
      "type": "FIX",
      "url": "https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-17431-r1.patch"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kingpong/perl-PDF-WebKit"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for"
}