The flaw lies in the merge function of easy‑pdf‑merge, which constructs shell commands by directly concatenating user‑supplied source paths, destination paths, or the maxHeap option and then passes them to child_process.exec(). Because child_process.exec() runs the command through a shell with the privileges of the running Node.js process, an attacker can inject shell metacharacters such as double quotes, semicolons, $() or backticks, thereby executing arbitrary commands. The result is a loss of confidentiality, integrity, and availability on any system where the vulnerable merge function is reachable.

The affected product is the open‑source easy‑pdf‑merge library authored by karuppiah7890. Versions from 0.1.0 through 0.2.6 contain the vulnerability. Any Node.js application that depends on one of these releases and exposes the merge functionality to untrusted input—whether through a public API, command‑line interface, or internal service—is at risk.

The CVSS score of 9.2 indicates critical severity. An EPSS score of 1% indicates a low but non‑zero probability that attackers will target this vulnerability, and the vulnerability is not listed in the CISA KEV catalog; however, the lack of a KEV listing does not diminish the risk. Based on the description, the likely attack vector is any interface that accepts source paths, destination paths, or the maxHeap option for the merge operation and is exposed to users who can supply arbitrary input. An attacker who can reach the merge function can craft input containing shell metacharacters, trigger child_process.exec(), and run arbitrary commands with the privileges of the Node.js process. Because this requires no additional authentication or privilege escalation, the potential impact is complete compromise of the affected system.