[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-41553":6},{"stargazers_count":4,"fetched_at":5},6,"2026-05-15T21:38:49.783Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":40,"aliases":41,"duplicate_of":9,"upstream":42,"downstream":43,"duplicates":44,"related":45,"reserved_at":9,"published_at":46,"modified_at":47,"state":48,"summary":49,"references_raw":56,"kevs":68,"epss":9,"epss_history":69,"metrics":70,"affected":77},"CVE-2026-41553","PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of \"data\" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.\n\nThis issue was fixed in PDF Export Module version 0.7.6.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-78","Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","weakness","Stable","Base","High",[20,24,28,32,36],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-15","Command Delimiters",[],{"id":29,"name":30,"techniques":31},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":33,"name":34,"techniques":35},"CAPEC-6","Argument Injection",[],{"id":37,"name":38,"techniques":39},"CAPEC-88","OS Command Injection",[],[],[],[],[],[],[],"2026-05-15T12:31:30.195Z","2026-05-15T13:13:14.917Z","Awaiting Analysis",{"cisa_kev":50,"cisa_ransomware":50,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":51,"severity_score":52,"severity_version":53,"severity_source":54,"severity_vector":55,"severity_status":48},false,"critical",10,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",[57,63],{"url":58,"sources":59,"tags":61},"https://cert.pl/en/posts/2026/05/CVE-2026-7182",[54,60],"nvd",[62],"Third Party Advisory",{"url":64,"sources":65,"tags":66},"https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities",[54,60],[67],"Release Notes",[],[],[71,74],{"source":54,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":72},{"baseScore":52,"baseSeverity":73,"vectorString":55,"impactScore":9,"exploitabilityScore":9},"CRITICAL",{"source":60,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":75},{"baseScore":52,"baseSeverity":73,"vectorString":76,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[78],{"ecosystem":9,"name":79,"vendor":80,"product":81,"cpe_part":82,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":83},"PDF Export Module","dhtmlx","pdf export module","a",[84],{"version":85,"is_range":86,"range_type":54,"version_start":87,"version_start_type":88,"version_end":89,"version_end_type":90,"fixed_in":9},">= 0.3.3, \u003C 0.7.6",true,"0.3.3","including","0.7.6","excluding"]