# CVE-2026-123357: GROBID is vulnerable to OS command injection through crafted PDF filenames

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto, which interpolates the path into a bash -c command string. A single quote in the filename can terminate the intended quoting, and ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java starts the resulting command through ProcessBuilder, allowing arbitrary commands to execute with GROBID process privileges. The bundled REST server path is not affected. This issue is fixed in version 0.9.1.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- grobidOrg / grobid: < 0.9.1 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 0 (none); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-78

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/grobidOrg/grobid/security/advisories/GHSA-mgxf-7mg7-qpmf (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/grobidOrg/grobid/pull/1477 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/grobidOrg/grobid/releases/tag/0.9.1 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-123357; retrieved 2026-11-06; source updated 2026-11-06

Revision: 3a2f18ddc93e3899b548c04c37fe45abd086e346b2070413005d17a0ab3d0607

Canonical: https://y2.dev/cve/CVE-2026-123357

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.