xhtml2pdf prior to 0.2.19 allows attackers to inject arbitrary operating‑system commands through the startViewer option. The vulnerability occurs because the file name supplied to --start-viewer is directly interpolated into an os.system call without proper escaping, enabling shell metacharacters and quotes to be executed. An attacker who can supply a crafted input file name can run any command as the user running the pisa tool, potentially compromising the host or deploying malware.

The affected vendor is xhtml2pdf; any installation using a version earlier than 0.2.19 is vulnerable. This includes release trains 0.2.18 and earlier. The vulnerability resides in the pisa module’s startViewer function. All environments that rely on xhtml2pdf to convert HTML to PDF and invoke startViewer are impacted.

The CVSS v3.1 base score is 8.5, indicating high severity. The EPSS score of 1% indicates that while this vulnerability is unlikely to be widely exploited at this time, it remains possible, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or requires the attacker to supply a maliciously named file via the –start-viewer flag; this inference is based on the description, which does not explicitly confirm remote exploitation. Exploitation would enable arbitrary OS commands to run as the user invoking the pisa tool, as the file name is interpolated unsafely into os.system. An attacker would need filesystem access or the ability to instruct the tool to process a maliciously named file, a scenario common in automated or untrusted file processing pipelines.