MEDIUM
Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)
Published Jul 15, 2026
6.1
MEDIUMCVSS 3.1
EPSS 0.27%
Description
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.
Affected products
-
- Version < 2.0.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Stirling-Tools | Stirling-PDF | n/a |
|
- < 2.0.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.0.0 x_refsource_MISCProductRelease Notes
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76 exploitx_refsource_CONFIRMVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.0.0 | x_refsource_MISCProductRelease Notes | |
| https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76 | exploitx_refsource_CONFIRMVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Jul 15, 2026
Updated Jul 15, 2026
Reserved Apr 21, 2026
Link CVE-2026-41580
CISA Vulnrichment
Updated Jul 15, 2026