CVE-2018-3746
Command Injection in pdfinfojs
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
- Record
CVE-2018-3746- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
CVE List No score
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
- Record
CVE-2018-3746- Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2018-0195 No score
The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
- Record
EUVD-2018-0195- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3pxp-6963-46r9
Command Injection in pdfinfojs
Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor.
Recommendation
Update to version 0.4.1 or later.
- Record
GHSA-3pxp-6963-46r9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSVGHSA-3pxp-6963-46r9
Command Injection in pdfinfojs
Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor.
Recommendation
Update to version 0.4.1 or later.
- Record
GHSA-3pxp-6963-46r9- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pdfinfojsnpm |
before 0.4.1 | 0.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-3746 is a critical vulnerability (CVSS 9.8) in Hackerone Pdfinfojs, published June 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.85%, the 92nd percentile. Fixed in pdfinfojs 0.4.1.