{"id":"EUVD-2026-29322","revision":"744a7ce301f94173a875efa17608b31c","records":[{"revision":"744a7ce301f94173a875efa17608b31c","observedAt":"2026-11-01T07:16:14.737+00:00","statement":{"source":"euvd","id":"EUVD-2026-29322","aliases":["CVE-2026-43893","GHSA-cw26-7653-2rp5"],"title":"exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-s…","description":"exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":null}],"references":["https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29322","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 11, 2026, 8:59:14 PM","dateUpdated":"May 12, 2026, 12:54:40 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29322","identifiers":["EUVD-2026-29322","CVE-2026-43893","GHSA-cw26-7653-2rp5"]},"retained":false,"historicalAffected":[]}],"coverage":[]}