tag
Exiftool
Critical
Gotenberg 8.29.1 Unauthenticated ExifTool Metadata Key Injection RCE (CVE-2026-42589)
CVE-2026-42589·
Gotenberg (document/PDF conversion microservice)
patched
High
exiftool-vendored.js Argument Injection via Newline-Delimited Tag Names (CVE-2026-43893)
CVE-2026-43893 / GHSA-cw26-7653-2rp5·
exiftool-vendored (npm package, Node.js wrapper around Phil Harvey's ExifTool)
patched
High
ExifTool Metadata Field Command Injection (macOS) — CVE-2026-3102
CVE-2026-3102·
ExifTool
unpatched