CVE-2026-41553: Dhtmlx PDF Export Module RCE Vulnerability

CVE-2026-41553 Overview

CVE-2026-41553 is a remote code execution vulnerability in the DHTMLX PDF Export Module used by the DHTMLX Gantt and Scheduler products. The flaw stems from missing sanitization of the data parameter, which is processed by Node.js on the server. An unauthenticated attacker can inject malicious JavaScript into the parameter and trigger execution in the server context. Successful exploitation leads to full server compromise. The issue is fixed in PDF Export Module version 0.7.6. The vulnerability is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Unauthenticated attackers can achieve remote code execution on servers running vulnerable DHTMLX PDF Export Module versions, leading to complete host compromise.

Affected Products

DHTMLX PDF Export Module versions prior to 0.7.6
DHTMLX Gantt (deployments using the vulnerable PDF Export Module)
DHTMLX Scheduler (deployments using the vulnerable PDF Export Module)

Discovery Timeline

2026-05-15 - CVE-2026-41553 published to NVD
2026-05-18 - Last updated in NVD database
2026-05-15 - CERT Poland publishes coordinated disclosure post referencing the issue

Technical Details for CVE-2026-41553

Vulnerability Analysis

The DHTMLX PDF Export Module is a Node.js-based server component that converts client-provided chart and schedule data into PDF documents. The vulnerable code path accepts a data parameter from HTTP requests and passes its value into a Node.js execution context without performing input validation or escaping. Because the parameter content is treated as code rather than as opaque data, an attacker who controls the parameter controls server-side execution.

Exploitation requires no authentication and no user interaction. The attacker sends a single HTTP request to the PDF export endpoint with a crafted data payload. The injected JavaScript runs with the privileges of the Node.js process, allowing the attacker to read files, spawn child processes, pivot inside the network, or deploy persistence.

Root Cause

The root cause is missing input sanitization on the data parameter combined with the use of a Node.js evaluation primitive on attacker-influenced content. CWE-78 categorizes this pattern as improper neutralization of special elements passed to a command interpreter. Any user-controllable value reaching an evaluation function without strict allow-listing produces equivalent risk.

Attack Vector

The attack vector is network-based and requires only HTTP access to the PDF export endpoint exposed by Gantt or Scheduler deployments. Internet-facing deployments are directly reachable by anonymous attackers. For technical specifics, refer to the CERT Poland advisory and the DHTMLX Gantt PDF Export changelog.

// No verified public proof-of-concept code is available.
// See CERT Poland advisory for technical details on the data parameter injection.

Detection Methods for CVE-2026-41553

Indicators of Compromise

HTTP POST or GET requests to PDF export endpoints (commonly /export/pdf or vendor-defined routes) containing unusual JavaScript syntax such as process, require(, child_process, or eval( inside the data parameter.
Unexpected child processes spawned by the Node.js process serving DHTMLX Gantt or Scheduler, including shells (/bin/sh, cmd.exe) or networking utilities (curl, wget, nc).
Outbound connections from the PDF export host to unfamiliar IP addresses immediately following an export request.
Files written outside the expected PDF output directory by the Node.js service account.

Detection Strategies

Inspect web server and reverse proxy logs for requests to PDF export endpoints with oversized or JavaScript-laden data parameter values.
Apply WAF rules that flag Node.js sink keywords (require, process.env, child_process, globalThis) appearing in request bodies destined for export routes.
Enable process-lineage telemetry to alert on shell or interpreter children of the node process associated with Gantt or Scheduler.

Monitoring Recommendations

Forward web server, application, and host telemetry into a centralized analytics pipeline and retain at least 90 days of history for retrospective hunts.
Baseline normal export request size and parameter structure, then alert on statistical outliers.
Monitor file integrity for the Node.js application directory to detect attacker-dropped artifacts.

How to Mitigate CVE-2026-41553

Immediate Actions Required

Upgrade the DHTMLX PDF Export Module to version 0.7.6 or later on every host running Gantt or Scheduler.
Inventory all internet-exposed Gantt and Scheduler deployments and restrict access to the PDF export endpoint pending patch deployment.
Review recent web access logs for suspicious data parameter content and investigate any matches as potential intrusions.
Rotate credentials, API keys, and secrets accessible to the Node.js process if compromise is suspected.

Patch Information

DHTMLX fixed the remote code execution and a related file read issue in PDF Export Module version 0.7.6. Update notes are published in the DHTMLX Gantt PDF Export Module changelog. Verify the installed module version after upgrade and redeploy any container images that bundle the older module.

Workarounds

Place the PDF export endpoint behind an authenticated reverse proxy and deny unauthenticated network access until patching is complete.
Deploy WAF signatures that block requests where the data parameter contains JavaScript keywords commonly used in Node.js sinks.
Run the Node.js export service under a least-privilege account with no write access outside its working directory and no outbound internet access where feasible.

bash

# Verify the installed PDF Export Module version
npm ls dhtmlx-pdf-export || npm ls @dhtmlx/pdf-export

# Upgrade to the patched release
npm install dhtmlx-pdf-export@0.7.6