CVE-2026-43893

exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.

• CWE-88

• https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43888Outline is a service that allows for collaborative documenta…8.7
• CVE-2026-43889Outline is a service that allows for collaborative documenta…6.5
• CVE-2026-4389The DSGVO snippet for Leaflet Map and its Extensions plugin …6.4
• CVE-2026-43890Outline is a service that allows for collaborative documenta…7.7
• CVE-2026-43891changedetection.io is a free open source web page change det…7.5
• CVE-2026-43892AntSword is a cross-platform website management toolkit. Pri…8.8
• CVE-2026-43894jq is a command-line JSON processor. In 1.8.1 and earlier, w…5.5
• CVE-2026-43895jq is a command-line JSON processor. In 1.8.1 and earlier, j…4.4
• CVE-2026-43896jq is a command-line JSON processor. In 1.8.1 and earlier, u…5.5
• CVE-2026-43897Link Preview JS extracts web links information. Prior to 4.0…8.7
• CVE-2026-43898SandboxJS is a JavaScript sandboxing library. Prior to 0.9.6…10
• CVE-2026-43899DeepChat is an open-source artificial intelligence agent pla…9.6