Node.js Injection Vulnerability in ExifTool by PhotoStructure

CVE-2026-43893

What is CVE-2026-43893?

ExifTool, provided through exiftool-vendored, has a vulnerability prior to version 35.19.0 where user-supplied strings that are interpolated into ExifTool arguments are not adequately sanitized. This situation allows newline or carriage return characters to interfere with argument parsing, potentially leading to argument injection. Attackers could manipulate ExifTool to process unintended file paths, provided they can control the inputs to affected APIs. While no remote code execution has been demonstrated, the implications of such injection vulnerabilities can lead to unauthorized file access or modifications. The issue has been resolved in version 35.19.0 with the introduction of controls that block unsafe characters.

References