CVE-2026-16770

PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection. Any caller that renders untrusted HTML lets the document choose the renderer's options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.

• CWE-88

• https://github.com/kingpong/perl-PDF-WebKit/issues/9
• https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-16770-r1.patch
• https://wkhtmltopdf.org/status.html
• https://www.openwall.com/lists/oss-security/2026/08/13/2

Published

Aug 13, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16765A vulnerability was determined in CodeAstro Online Classroom…7.3
• CVE-2026-16766Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl a…9.8
• CVE-2026-16767A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2.…6.5
• CVE-2026-16768A flaw was found in gdk-pixbuf. When parsing a specially cra…5.3
• CVE-2026-16769An unencrypted 'pause encryption request' message causes a d…7.1
• CVE-2026-1677Zephyr sockets created with `IPPROTO_TLS_1_3` can still nego…5.3
• CVE-2026-16771In firmware versions 2.7.7 and earlier, the Arris BGW210‑700…8.8
• CVE-2026-16772In Akaunting versions <= 3.1.21, low‑privileged authenticate…8.1
• CVE-2026-16773The WPBot – AI ChatBot for Live Support, Lead Generation, AI…5.3
• CVE-2026-16774The Chatbot plugin for WordPress is vulnerable to Missing Au…5.3
• CVE-2026-16775The Smash Balloon Social Post Feed – Simple Social Feeds for…6.4
• CVE-2026-16779The Kubio AI Page Builder plugin for WordPress is vulnerable…4.3