{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.0.0"}],"component":"pdf-image","cve_ids":["CVE-2026-26830"],"ecosystem":"npm","epss":0.02505,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-q5mh-72xg-628w","id":"tcs_01M5KG59BTTQPDXX8QDM9ZGNH8","modified_at":"2026-03-27T18:56:22.340018Z","published_at":"2026-03-25T15:31:29Z","references":["https://osv.dev/vulnerability/GHSA-q5mh-72xg-628w","https://nvd.nist.gov/vuln/detail/CVE-2026-26830","https://github.com/mooz/node-pdf-image","https://github.com/zebbernCVE/CVE-2026-26830"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-q5mh-72xg-628w","url":"https://osv.dev/vulnerability/GHSA-q5mh-72xg-628w"}],"summary":"pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter"}