CyberRota Analysis
AI-GeneratedCatalyst::View::Wkhtmltopdf versions prior to 0.6.1 are vulnerable to remote code execution due to unsanitized user-controlled options passed to the wkhtmltopdf command, enabling shell command injection. Any web application utilizing this library to render PDFs with user-defined parameters should prioritize immediate remediation, as the risk of exploitation is critical. Organizations relying on this package should consider migrating to alternative solutions, given that the wkhtmltopdf project is no longer actively maintained.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.