The vulnerability enables any caller that supplies untrusted HTML to PDF::WebKit to inject command‑line options into wkhtmltopdf via meta tags. Each <meta name="pdf-webkit-KEY" content="VALUE"> element is parsed, the key is normalized to a valid option name, and the value is forwarded unchanged, with a value of "yes" turning the option into a bare flag. This mechanism lets an attacker supply options such as --enable-local-file-access or --cookie-jar, enabling the renderer to read local files or write to arbitrary paths. Because wkhtmltopdf is executed with a directly constructed argument array, the flaw is non‑shell argument injection but provides equivalent privilege escalation or data exfiltration capabilities.

Affected vendor is MITHALDU and the product is PDF::WebKit for Perl. All releases up to and including version 1.2 are impacted; no other vendors or products are affected.

The CVSS score is not disclosed, EPSS is unavailable, and the vulnerability is not listed in CISA's KEV catalog. Inference indicates the likely attack vector is an attacker sending crafted HTML with meta tags to override module defaults. As wkhtmltopdf runs with the privileges of the calling process, successful exploitation can lead to local file read or write, compromising confidentiality, integrity, or availability. Given that wkhtmltopdf is no longer actively maintained, the risk posture is considered high for systems rendering untrusted content.