CVE Catalog
CVE-2026-36576
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk1.49%
71th percentile - higher than 71% of all known CVEs
Summary
An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary system commands on the server, potentially leading to full system compromise.
Recommendation
Update docker-wkhtmltopdf-aas to a version after commit 9f50579 that includes the fix. If not possible, restrict access to the service.
Original NVD description (English source)
An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request.