CVE-2026-43893

{
  "id": "CVE-2026-43893",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T22:22:14.033",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0."
    },
    {
      "lang": "es",
      "value": "exiftool-vendored proporciona acceso multiplataforma a ExifTool para Node.js. Antes de la versión 35.19.0, exiftool-vendored inicia ExifTool en modo -stay_open True -@ -, donde los argumentos se leen desde stdin uno por línea. En las versiones afectadas, varias cadenas proporcionadas por el llamador se interpolaron en los argumentos de ExifTool sin rechazar los delimitadores de línea. Un salto de línea o retorno de carro dentro de una de esas cadenas podría dividir un único argumento previsto en múltiples argumentos de ExifTool, permitiendo la inyección de argumentos. La corrección también rechaza los bytes NUL como caracteres de control inseguros. Las aplicaciones que pasan cadenas controladas por el atacante a las API afectadas pueden permitir a un atacante hacer que ExifTool lea archivos accesibles para el proceso de ExifTool, o escribir la salida en rutas del sistema de archivos elegidas por el atacante y accesibles para ese proceso. No se ha demostrado ejecución remota de código. Esta vulnerabilidad se corrige en la versión 35.19.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "photostructure",
          "product": "exiftool-vendored.js",
          "versions": [
            {
              "version": "< 35.19.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-12T12:54:33.277455Z",
          "id": "CVE-2026-43893",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/photostructure/exiftool-vendored.js/security/advisories/GHSA-cw26-7653-2rp5",
      "source": "[email protected]"
    }
  ]
}