CVE-2026-78637: node-poppler Argument Injection RCE Vulnerability

CVE-2026-78637 Overview

CVE-2026-78637 is an argument injection vulnerability in the Fdawgs node-poppler library, affecting versions up to 9.1.2 and 10.0.1. The flaw resides in the argument injection handler within src/index.js, impacting functions such as pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate, and pdfUnite. An attacker can manipulate the file_path argument to inject additional command-line options into the underlying Poppler binary. The vulnerability is remotely exploitable and maps to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers can inject arbitrary CLI arguments into Poppler binaries invoked by applications using node-poppler, potentially altering output behavior, exposing files, or influencing downstream processing.

Affected Products

Fdawgs node-poppler versions up to 9.1.2
Fdawgs node-poppler versions up to 10.0.1
Node.js applications wrapping Poppler utilities via node-poppler

Discovery Timeline

2026-08-25 - CVE-2026-78637 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78637

Vulnerability Analysis

The node-poppler library wraps Poppler command-line utilities and exposes them as JavaScript functions. Each wrapper method accepts a file_path parameter that is passed as a positional argument to the underlying binary. Prior to the patch, the argument parser did not emit an end-of-options marker (--) before appending positional file paths. As a result, a file_path value beginning with - or -- is interpreted by the Poppler binary as an option rather than a file name. Attackers who control the file_path argument can therefore inject arbitrary CLI flags supported by the invoked utility.

Root Cause

The parseOptions function in src/index.js constructs the argument list passed to Poppler binaries by concatenating named options with the caller-supplied file path. The function did not terminate option parsing before the positional argument, allowing user-supplied paths to be parsed as flags [CWE-74]. This is a classic argument injection pattern where the boundary between options and operands is not enforced.

Attack Vector

Exploitation requires an application that forwards untrusted input into any of the affected pdf* wrapper functions as the file_path parameter. The attack is remote and requires no authentication or user interaction. A crafted path value carrying option-like syntax is passed to functions such as pdfToText or pdfToCairo, changing binary behavior. Impact depends on the invoked utility and may include arbitrary output file locations, disclosure of file contents, or invocation of unintended features.

javascript

  * @param {PopplerAcceptedOptions} acceptedOptions - Object containing accepted options.
  * @param {PopplerOptions} options - Object containing options to pass to the binary.
  * @param {string} [version] - Semantic version of the binary.
- * @returns {string[]} Array of CLI arguments.
+ * @returns {string[]} Array of CLI arguments, terminated with an end-of-options marker (`--`).
  * @throws {Error} If invalid arguments provided.
  */
 function parseOptions(acceptedOptions, options, version) {

Source: GitHub Commit db6e3f79d3beb20601be7e59669c39811ae3c330. The patch terminates option parsing with -- so user-supplied file paths cannot be interpreted as options.

Detection Methods for CVE-2026-78637

Indicators of Compromise

Process telemetry showing Poppler binaries (pdftotext, pdftocairo, pdftoppm, pdfinfo, pdftohtml, pdftops, pdffonts, pdfdetach, pdfseparate, pdfunite) invoked with unexpected flags immediately followed by suspicious paths.
Application logs containing file_path values that begin with - or --.
Unexpected file writes or reads from directories not owned by the application when PDF processing runs.

Detection Strategies

Instrument the Node.js application to log the full argument array passed to spawn/execFile and alert on positional operands starting with -.
Scan repositories that import node-poppler and flag call sites where user input reaches the file_path parameter without validation.
Compare the installed node-poppler version against the patched release published after commit db6e3f79d3beb20601be7e59669c39811ae3c330.

Monitoring Recommendations

Monitor child-process creation from Node.js runtimes and correlate command lines against a baseline of expected Poppler flags.
Track outbound file operations from Poppler processes and alert on writes to paths outside the application's working directory.
Aggregate web request logs and flag PDF-processing endpoints receiving path parameters containing shell-style option syntax.

How to Mitigate CVE-2026-78637

Immediate Actions Required

Upgrade node-poppler to the version containing commit db6e3f79d3beb20601be7e59669c39811ae3c330 in every project that consumes the library.
Audit application code paths where external input is forwarded to pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate, or pdfUnite.
Reject file path inputs beginning with - at the application boundary until the upgrade is deployed.

Patch Information

The fix is delivered in Fdawgs node-poppler commit db6e3f79d3beb20601be7e59669c39811ae3c330, landed via Pull Request #842 resolving Issue #822. The patch appends an end-of-options marker (--) to the argument array produced by parseOptions, forcing the Poppler binary to treat any subsequent value as a positional operand.

Workarounds

Normalize file paths server-side using path.resolve and validate that the resulting absolute path begins with an expected base directory.
Reject any file_path value whose basename starts with - before invoking node-poppler functions.
Wrap node-poppler calls in a helper that explicitly prepends -- to the argument list before it reaches the child process.

bash

# Upgrade node-poppler to the patched release
npm install node-poppler@latest

# Verify the installed version includes the fix commit
npm ls node-poppler