CVE-2026-123357 | grobidOrg GROBID up to 0.9.0 PDF Conversion DocumentSource.java ProcessRunner.run filename os command injection

A vulnerability classified as problematic has been found in grobidOrg GROBID up to 0.9.0. Affected by this issue is the function ProcessRunner.run of the file grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java of the component PDF Conversion. Performing a manipulation of the argument filename results in os command injection.

This vulnerability is identified as CVE-2026-123357. The attack can be initiated remotely. There is not any exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More