Skip to content
OpenAdvisories

Package · npm

exiftool-vendored

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.2
    CVE-2026-43893 Public exploit

    exiftool-vendored: Argument injection via newline characters in tag names

    exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings wer…

    photostructure exiftool-vendored.js exiftool-vendored npm
  • High 7.8
    GHSA-4whq-r978-2x68

    Arbitrary code execution in ExifTool

    ### Impact Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads. ### Patches ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0. ### …

    exiftool-vendored npm