CVE-2026-36576: Docker-wkhtmltopdf-aas RCE Vulnerability

CVE-2026-36576 Overview

CVE-2026-36576 is an OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas, a Dockerized HTML-to-PDF conversion service that wraps the wkhtmltopdf binary behind an HTTP API. The flaw affects builds up to and including commit 9f50579. Attackers can execute arbitrary operating system commands by sending a crafted POST request to the service. The issue is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because the service is commonly deployed as a containerized microservice exposed to internal applications, exploitation can lead to full compromise of the container and lateral movement within the cluster.

Critical Impact
Unauthenticated remote attackers can execute arbitrary commands inside the container running the PDF conversion service, leading to data exposure and potential pivot into adjacent workloads.

Affected Products

openlabs docker-wkhtmltopdf-aas up to commit 9f50579
The app.py request handler in the same repository
Docker images derived from the openlabs/docker-wkhtmltopdf-aas Docker Hub repository

Discovery Timeline

2026-06-03 - CVE-2026-36576 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-36576

Vulnerability Analysis

The docker-wkhtmltopdf-aas project exposes an HTTP endpoint that accepts conversion requests and invokes the wkhtmltopdf command-line tool to render HTML into PDF. The handler in app.py builds a shell command from user-controlled fields received in the POST body and passes the result to an OS-level command executor without sufficient neutralization of shell metacharacters. As a result, any user able to reach the service can break out of the intended argument context and append arbitrary commands.

Because the service requires no authentication by default and listens on a network-reachable port, this vulnerability is exploitable remotely without privileges or user interaction. Successful exploitation grants code execution in the container with the privileges of the service process, which is frequently root in default container images.

Root Cause

The root cause is unsafe construction of an OS command from untrusted HTTP input in app.py. Parameters from the POST request are concatenated into a command string and executed through a shell, rather than being passed as a discrete argument list to a non-shell process API. Without input sanitization or allow-list validation, shell metacharacters such as ;, |, &&, and backticks are interpreted by the shell, enabling injection. See the affected handler in the GitHub source file and the related GitHub issue discussion.

Attack Vector

An attacker sends a crafted POST request to the conversion endpoint with a payload field containing shell metacharacters followed by an arbitrary command. The shell interprets the injected sequence and executes the attacker's command alongside the legitimate wkhtmltopdf invocation. Output can be exfiltrated by writing to attacker-controlled URLs, redirecting into the generated PDF, or initiating a reverse shell to a remote host. No verified public proof-of-concept code has been associated with this CVE at the time of publication; refer to the linked GitHub project repository for technical context.

Detection Methods for CVE-2026-36576

Indicators of Compromise

HTTP POST requests to the conversion endpoint containing shell metacharacters such as ;, |, `, $(, or && within URL or option fields.
Child processes spawned by the docker-wkhtmltopdf-aas service that are not wkhtmltopdf, including sh, bash, curl, wget, nc, or python.
Outbound network connections from the container to unexpected hosts immediately following a POST to the rendering endpoint.
New or unexpected files written outside the temporary PDF output directory inside the container.

Detection Strategies

Inspect web server and reverse proxy access logs for POST bodies and URL parameters containing shell metacharacters targeting the PDF service.
Use process telemetry to alert on the wkhtmltopdf service process spawning interactive shells or networking utilities.
Apply container runtime policy enforcement to flag deviations from the expected process tree of the conversion service.

Monitoring Recommendations

Forward container stdout, stderr, and audit logs to a centralized analytics platform and alert on shell invocations originating from the PDF service.
Monitor egress traffic from the container; the service should not initiate outbound connections beyond fetching HTML resources for rendering.
Track image and commit hashes deployed across environments to identify hosts still running vulnerable builds at or before commit 9f50579.

How to Mitigate CVE-2026-36576

Immediate Actions Required

Remove direct exposure of the docker-wkhtmltopdf-aas service from untrusted networks and place it behind an authenticated reverse proxy.
Restrict the container's network egress with firewall or service-mesh policies so it can only reach required destinations.
Run the container as a non-root user with a read-only root filesystem and drop all unnecessary Linux capabilities.
Audit historical access logs for POST payloads containing shell metacharacters and investigate any hosts that exhibited unexpected child processes.

Patch Information

No official patched release has been published for the openlabs docker-wkhtmltopdf-aas project at the time of writing. Operators should monitor the GitHub project repository and the related GitHub issue discussion for fixes. Until an upstream patch is available, consider forking the project and replacing the vulnerable command construction in app.py with a parameterized invocation that passes arguments as a list and disables shell interpretation.

Workarounds

Place an authenticating gateway in front of the service and require mutual TLS or signed tokens for all requests.
Add an input validation layer that rejects any field containing shell metacharacters before forwarding to the converter.
Replace the shell-based execution path with a direct call to the wkhtmltopdf binary using an argument array, ensuring no string concatenation with user input.
Deploy the container with a restrictive seccomp and AppArmor profile that blocks the execution of shells and network utilities not required by wkhtmltopdf.

bash

# Example hardened docker run configuration
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --user 1001:1001 \
  --network internal-pdf-net \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  openlabs/docker-wkhtmltopdf-aas:latest