Versions of `pdfinfojs` before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the `pdfinfojs` constructor.

## Recommendation

Update to version 0.4.1 or later.

Affected Packages

npm pdfinfojs

Affected versions: 0 (fixed in 0.4.1)

Related CVEs

CVE-2018-3746

Key Information

GHSA ID

GHSA-3pxp-6963-46r9

Published

June 7, 2018 7:43 PM

Last Modified

January 31, 2023 1:38 AM

CVSS Score

9.0 /10

Primary Ecosystem

npm

Primary Package

pdfinfojs

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 4, 2025 6:05 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.