---
id: CVE-2026-110642
title: >-
  xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in
  pisa.startViewer() that allows attackers to execute commands by interpolating
  unescaped file names into os.system
summary: >-
  xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in
  pisa.startViewer() that allows attackers to execute commands by interpolating
  unescaped file names into os.system. Attackers can supply an input file whose
  name co…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:17:11.027'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110642'
references:
  - url: >-
      https://github.com/xhtml2pdf/xhtml2pdf/blob/v0.2.18/xhtml2pdf/pisa.py#L393-L400
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/xhtml2pdf/xhtml2pdf/commit/f86380dad15b3a6810201d08755a3ee6b19d5063
    label: disclosure@vulncheck.com
  - url: 'https://github.com/xhtml2pdf/xhtml2pdf/pull/835'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/xhtml2pdf/xhtml2pdf/releases/tag/v0.2.19'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xhtml2pdf-before-0.2.19-os-command-injection-via-startviewer-file-name
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.015Z'
---

## Overview

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.