The PDF Export Module in DHTMLX's Gantt and Scheduler products fails to sanitize the 'data' parameter, allowing an unauthenticated attacker to inject malicious JavaScript that is processed and executed by Node.js. This flaw maps to CWE‑78 and can result in full server compromise, granting the attacker complete control over the affected host. The vulnerability is explicitly stated to allow remote code execution through the data parameter, and the description assigns sufficient technical detail to confirm the attack vector. No other mitigations are intrinsically present, so exploitation requires only the malformed input.

Affected systems are installations of the DHTMLX PDF Export Module, which is used by the Gantt and Scheduler components. Any deployment that is still using a version prior to 0.7.6 is vulnerable; the fix was released in version 0.7.6. Consumers of the module should upgrade to 0.7.6 or later to eliminate the flaw.

The CVSS score of 10.0 denotes a critical severity, and while the EPSS score is not available, the absence of an exploitable public proof of concept means that overall exploitation likelihood could be lower, yet the potential impact is extreme. The vulnerability is not listed in the CISA KEV catalog, implying no active exploitation reports at the time of this analysis. Attackers could target the export endpoint directly over the network, with no authentication required, to leverage the injection flaw and execute arbitrary code on the server.