CVE-2022-4643 — docconv pdf_ocr.go ConvertPDFImages os command injection

Back Back to CVE browser

CRITICAL

docconv pdf_ocr.go ConvertPDFImages os command injection

Published Dec 21, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.73%

Description

A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VDB-216502 is the identifier assigned to this vulnerability.

Affected products

Vendor n/a Product Docconv Default
n/a
- Version
  1.0
  Status
  affected
  Constraints
  -
- Version
  1.1
  Status
  affected
  Constraints
  -
- Version
  1.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Docconv

n/a

Version	Status	Constraints
1.0	affected	-
1.1	affected	-
1.2	affected	-

github.com/sajari/docconv

Go

Introduced 0 Fixed 1.2.1
code.sajari.com/docconv

Go

Introduced 1.1.0 Fixed 1.3.5

Ecosystem	Package	Introduced	Fixed
Go	github.com/sajari/docconv	0	1.2.1
Go	code.sajari.com/docconv	1.1.0	1.3.5

Remediation

No remediation recorded yet.

Metrics

1.73% 0.01734

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01734

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (17 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.73% (0.01734)	76.81th	v5 (v2026.06.15)
Jun 15, 2026	1.73% (0.01734)	74.61th	v5 (v2026.06.15)
Dec 31, 2025	3.84% (0.03837)	87.83th	v4 (v2025.03.14)
Nov 21, 2025	0.48% (0.00484)	64.44th	v4 (v2025.03.14)
Nov 18, 2025	3.84% (0.03837)	87.05th	v4 (v2025.03.14)
Mar 17, 2025	0.37% (0.00370)	56.66th	v4 (v2025.03.14)
Dec 12, 2024	0.21% (0.00205)	59.39th	v3 (v2023.03.01)
Jun 30, 2024	0.17% (0.00171)	54.38th	v3 (v2023.03.01)
Jun 2, 2024	0.16% (0.00160)	52.57th	v3 (v2023.03.01)
Feb 4, 2024	0.18% (0.00180)	55.34th	v3 (v2023.03.01)
Jan 23, 2024	0.16% (0.00164)	53.05th	v3 (v2023.03.01)
Jan 10, 2024	0.14% (0.00138)	49.22th	v3 (v2023.03.01)
Dec 28, 2023	0.11% (0.00114)	44.73th	v3 (v2023.03.01)
Nov 21, 2023	0.07% (0.00065)	27.32th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00057)	21.63th	v3 (v2023.03.01)
Mar 6, 2023	2.36% (0.02359)	81.45th	v2 (v2022.01.01)
Dec 22, 2022	2.36% (0.02359)	81.05th	v2 (v2022.01.01)

Weaknesses (1)

CWE-78

OS Command Injection

References (8)

https://github.com/advisories/GHSA-6m4h-hfpp-x8cx
Advisory
https://github.com/sajari/docconv/commit/b19021ade3d0b71c89d35cb00eb9e589a121faa5
mitigationpatchThird Party Advisory
https://github.com/sajari/docconv/pull/110
relatedPatchThird Party Advisory
https://github.com/sajari/docconv/releases/tag/v1.2.1
mitigationPatchRelease NotesVendor Advisory
https://github.com/sajari/docconv/releases/tag/v1.3.5
https://nvd.nist.gov/vuln/detail/CVE-2022-4643
https://pkg.go.dev/vuln/GO-2022-1184
https://vuldb.com/?id.216502
technical-descriptionvdb-entryThird Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-6m4h-hfpp-x8cx		Advisory
https://github.com/sajari/docconv/commit/b19021ade3d0b71c89d35cb00eb9e589a121faa5		mitigationpatchThird Party Advisory
https://github.com/sajari/docconv/pull/110		relatedPatchThird Party Advisory
https://github.com/sajari/docconv/releases/tag/v1.2.1		mitigationPatchRelease NotesVendor Advisory
https://github.com/sajari/docconv/releases/tag/v1.3.5
https://nvd.nist.gov/vuln/detail/CVE-2022-4643
https://pkg.go.dev/vuln/GO-2022-1184
https://vuldb.com/?id.216502		technical-descriptionvdb-entryThird Party Advisory