HTML Injection Vulnerability in Stirling-PDF by Stirling Tools
CVE-2026-41580

6.1MEDIUM

Key Information:

Vendor

Stirling-tools

Status
Stirling-PDF
Vendor
CVE Published:
15 July 2026

What is CVE-2026-41580?

Stirling-PDF, a web application for PDF management, was found to be susceptible to an HTML injection vulnerability. The /get-info-on-pdf endpoint could render the Title and Author metadata fields without adequate HTML encoding or sanitization. As a result, an attacker could craft a malicious PDF that executes arbitrary JavaScript within the browser of any user viewing the output page. This critical oversight was rectified in version 2.0.0 of Stirling-PDF, emphasizing the importance of proper input validation and output encoding to safeguard against such attacks.

Affected Version(s)

Stirling-PDF < 2.0.0

References

https://github.com/Stirling-Tools/Stirling-PDF/security/a...
x_refsource_CONFIRM
https://github.com/Stirling-Tools/Stirling-PDF/releases/t...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.