{"id":"EUVD-2026-29322","enisaUuid":"d41d25a5-65f6-3b52-abb4-0dd9d29fcd60","description":"exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.","datePublished":"May 11, 2026, 8:59:14 PM","dateUpdated":"May 12, 2026, 12:54:40 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5\n","aliases":"CVE-2026-43893\nGHSA-cw26-7653-2rp5\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"62dc2837-58ca-35bc-a1bc-bb1c9ccbb84a","product":{"name":"exiftool-vendored.js","vendor":{"name":"photostructure"}},"product_version":"\u003c 35.19.0"}],"enisaIdVendor":[{"id":"078e89de-132b-3910-97b5-b0b938caaae0","vendor":{"name":"photostructure"}}],"enisaIdVulnerability":[{"id":"807f0ac2-28f3-38cb-9834-8b3e81c9a396","vulnerability":{"id":"GHSA-cw26-7653-2rp5","description":"exiftool-vendored vulnerable to argument injection via newline characters in tag names","datePublished":"May 5, 2026, 7:53:47 PM","dateUpdated":"May 13, 2026, 2:19:52 PM","baseScore":0.0,"references":"https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43893\nhttps://exiftool.org/TagNames\nhttps://exiftool.org/exiftool_pod.html#stay_open-FLAG\nhttps://github.com/photostructure/exiftool-vendored.js\n","enisa_id":"EUVD-2026-29322\n","aliases":"GHSA-cw26-7653-2rp5\nCVE-2026-43893\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d1f78e7b-ceb4-3c13-b972-04909d77e677","vulnerability":{"id":"CVE-2026-43893","description":"exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.","datePublished":"May 11, 2026, 8:59:14 PM","dateUpdated":"May 12, 2026, 12:54:40 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5\n","enisa_id":"EUVD-2026-29322\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Oct 27, 2026, 7:18:18 AM","vulnerabilityProduct":[{"id":"b7885b1c-86f4-3ab7-9d2a-9bcc4ce89a60","product":{"name":"exiftool-vendored.js","vendor":{"name":"photostructure"}},"product_version":"\u003c 35.19.0"}],"vulnerabilityVendor":[{"id":"10fd73e2-53ad-34e3-846b-e2a0241a9745","vendor":{"name":"photostructure"}}]}}],"enisaIdAdvisory":[]}