photostructure vulnerabilities

Products

• exiftool-vendored.js 1

Latest photostructure CVEs

Newest publication first

1. CVE-2026-43893 exiftool-vendored: Argument injection via newline characters in tag names

   Published 2026-05-11

   High·CVSS 8.2 EPSS 0.49%

   exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into E...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.