CVE-2026-34071

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.

• CWE-79

• https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xmhg-fv84-jgfcExploit, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34066nimiq-blockchain provides persistent block storage for Nimiq…5.3
• CVE-2026-34067nimiq-transaction provides the transaction primitive to be u…6.5
• CVE-2026-34068nimiq-transaction provides the transaction primitive to be u…6.8
• CVE-2026-34069nimiq/core-rs-albatross is a Rust implementation of the Nimi…5.3
• CVE-2026-3407A vulnerability was determined in YosysHQ yosys up to 0.62. …3.3
• CVE-2026-34070LangChain is a framework for building agents and LLM-powered…7.5
• CVE-2026-34072Cr*nMaster (cronmaster) is a Cronjob management UI with huma…9.8
• CVE-2026-34073cryptography is a package designed to expose cryptographic p…5.3
• CVE-2026-34076Clerk JavaScript is the official JavaScript repository for C…7.4
• CVE-2026-34077React Router is a router for React. In versions 7.7.0 throug…7.5
• CVE-2026-34078Flatpak is a Linux application sandboxing and distribution f…10
• CVE-2026-34079Flatpak is a Linux application sandboxing and distribution f…7.5