CVE-2026-41553CWE-78

Remote Code Execution in PDF Export Module

Critical · published May 15, 2026

CVSS v4.0
10.0
EPSS
1%
Percentile
64.0
In the wild
Unconfirmed
What it is

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.

This issue was fixed in PDF Export Module version 0.7.6.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01049 · 64.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-15T12:31Z
EPSS history
Timeline
  • 15 MAY 12:31Z
    Remote Code Execution in PDF Export Module
    cvelistv5