exiftool‑vendored allows attacker‑controlled strings with newline or carriage return characters to be interpolated into ExifTool arguments. The newline splits a single intended argument into multiple ExifTool arguments, enabling argument injection. Although no remote code execution has been demonstrated, an attacker can cause ExifTool to read files or write output to arbitrary filesystem paths that are accessible to the ExifTool process, potentially exposing sensitive data or overwriting files.

The vulnerability exists in version 35.18.0 and earlier of the photostructure exiftool‑vendored.js package. Any Node.js application that imports this package and passes user‑supplied strings to its exposed APIs, such as tag manipulation functions, is affected.

The CVSS score of 8.2 indicates high severity, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred as local or embedded data passing; an attacker must supply crafted input that reaches the vulnerable API. If the application runs with elevated privileges, the resulting improper file access could lead to confidentiality or integrity compromise.