CVE-2026-36576
Description
An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=commit 9f50579
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application concatenates user-supplied options into a shell command without proper validation or sanitization."
Attack vector
An attacker can send a crafted POST request with JSON data containing malicious options. These options can include command substitutions or chained commands, which are then passed to a shell interpreter. The application uses these options to construct a command for wkhtmltopdf, leading to arbitrary command execution as root on the server [ref_id=1].
Affected code
The vulnerability lies within the app.py component, specifically in the loop that constructs the arguments for the wkhtmltopdf command. User-supplied options are appended to the `args` list and then joined into a string which is passed to the `execute()` function for shell evaluation [ref_id=1].
What the fix does
The advisory recommends replacing the use of `execute(' '.join(args))` with `subprocess.run(args)` which does not evaluate the string via a shell. Additionally, it suggests implementing an allowlist for permitted wkhtmltopdf options and validating their values to prevent injection [ref_id=1].
Preconditions
- authNo authentication is required to exploit this vulnerability [ref_id=1].
- inputThe attacker must provide a crafted JSON POST request with malicious option keys or values [ref_id=1].
Reproduction
curl -X POST -H "Content-Type: application/json" -d '{"contents":"PGh0bWw+PGJvZHk+PC9ib2R5PjwvaHRtbD4=","options":{"margin-top":"$(id > /tmp/pwned.txt)""}}' http://TARGET:PORT/ curl -X POST -H "Content-Type: application/json" -d '{"contents":"PGh0bWw+PGJvZHk+PC9ib2R5PjwvaHRtbD4=","options":{"margin-top 0; id > /tmp/pwned2.txt;":""}}' http://TARGET:PORT/
Generated on Jun 3, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.