CVE-2026-16770 | CVSS: 9.8 | 严重级别: CRITICAL
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document.
For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching –[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta deriv
参考链接:
• https://github.com/kingpong/perl-PDF-WebKit/issues/9
• https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-16770-r1.patch
• https://wkhtmltopdf.org/status.html
📌 数据来源: NVD 官方