The vulnerability enables any caller that supplies untrusted HTML to PDF::WebKit to inject command‑line options into wkhtmltopdf via meta tags. Each <meta name="pdf-webkit-KEY" content="VALUE"> element is parsed; the key is normalized to a valid option name, and the value is forwarded unchanged, with a value of "yes" turning the option into a bare flag. This mechanism allows an attacker to supply options such as --enable-local-file-access or --cookie-jar, letting the renderer read local files or write to arbitrary paths. Because wkhtmltopdf is executed with a carefully constructed argument array, this is an instance of CWE-88: Argument Injection rather than shell injection, and provides equivalent privilege escalation or data exfiltration capabilities.

Affected vendor is MITHALDU and the product is PDF::WebKit for Perl. All releases up to and including version 1.2 are impacted; no other vendors or products are affected.

The CVSS score is 9.8, EPSS is less than 1%, and the vulnerability is not listed in CISA's KEV catalog. Inference indicates the likely attack vector is an attacker sending crafted HTML with meta tags to override module defaults. As wkhtmltopdf runs with the privileges of the calling process, successful exploitation can lead to local file read or write, compromising confidentiality, integrity, or availability. Given that wkhtmltopdf is no longer actively maintained, the risk posture is considered high for systems rendering untrusted content.