node-poppler contains an argument injection flaw in multiple PDF processing functions. By manipulating the file_path parameter, an attacker can inject unintended arguments, potentially executing arbitrary commands. This is a classic injection vulnerability as indicated by the CWE identifiers. The consequence is that a remote attacker controlling file_path could compromise confidentiality, integrity, or availability of the system.

All versions of fdawgs/node-poppler up to and including 9.1.2 and 10.0.1 are affected. The vulnerable code resides in src/index.js and targets the pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate, and pdfUnite functions when a manipulated file_path is supplied.

The CVSS score of 6.9 rates this issue as moderate severity. No EPSS data is available, so the exact exploitation probability is uncertain, but the flaw is theoretically exploitable from a remote context as the description notes. It is not yet listed in the CISA KEV catalog, indicating no known large‑scale exploitation, yet the remote execution potential warrants prompt remediation.