CVE-2026-41580

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.0.0	Product Release Notes
https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76	Exploit Vendor Advisory
https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Stirling-PDF es una aplicación web alojada localmente que facilita varias operaciones en archivos PDF. Antes de la versión 2.0.0, el endpoint /get-info-on-pdf de Stirling-PDF renderizaba los campos de metadatos Título y Autor del PDF sin la codificación HTML o sanitización adecuadas, permitiendo que un PDF manipulado ejecutara JavaScript controlado por el atacante en el navegador de un usuario que visualizara la página resultante. Este problema está solucionado en la versión 2.0.0.

Information

Published : 2026-07-15 16:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-41580

Mitre link : CVE-2026-41580

CVE.ORG link : CVE-2026-41580

JSON object : View

Products Affected

stirling

stirling_pdf

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-41580", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41580", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T15:33:07.041467Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Stirling-Tools", "product": "Stirling-PDF", "versions": [{"status": "affected", "version": "< 2.0.0"}]}]}], "published": "2026-07-15T16:16:45.223", "references": [{"url": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.0.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0."}, {"lang": "es", "value": "Stirling-PDF es una aplicaci\u00f3n web alojada localmente que facilita varias operaciones en archivos PDF. Antes de la versi\u00f3n 2.0.0, el endpoint /get-info-on-pdf de Stirling-PDF renderizaba los campos de metadatos T\u00edtulo y Autor del PDF sin la codificaci\u00f3n HTML o sanitizaci\u00f3n adecuadas, permitiendo que un PDF manipulado ejecutara JavaScript controlado por el atacante en el navegador de un usuario que visualizara la p\u00e1gina resultante. Este problema est\u00e1 solucionado en la versi\u00f3n 2.0.0."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA4EE676-6D9F-46CD-80AA-ADA0435E8C3B", "versionEndExcluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}