External risk intelligence

Openlabs docker-wkhtmltopdf-aas OS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-36576

This component is designed as an Application as a Service (AAS) providing a web-based API endpoint for HTML-to-PDF conversion. Such services are commonly deployed as internet-facing or edge-accessible microservices to process requests from external web applications or clients.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the openlabs docker-wkhtmltopdf-aas component, which could allow unauthorized execution of commands through crafted network requests. While the specific business impact requires further assessment, this type of issue generally poses a risk to system integrity and data security.

Command execution flaw in a web service.
Affects a service that processes external requests.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending a specially crafted POST request to the service's web API. This exposed service, designed for HTML-to-PDF conversion, processes incoming requests without properly validating user-supplied data, allowing arbitrary commands to be executed on the underlying system.

No authentication or user interaction needed.
Specially crafted POST request to API.
Arbitrary command execution on host.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on the system by sending a specially crafted POST request to the `app.py` component. This could affect the service's behavior and potentially expose or compromise system data when the service is exposed externally.

System commands could be executed.
Via crafted network requests.
Service availability and integrity compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

The app.py component within the openlabs docker-wkhtmltopdf-aas service is vulnerable to OS command injection, allowing unauthenticated remote attackers to execute arbitrary code. Responsibility for this service likely falls to the platform or infrastructure teams managing the Docker deployment, with coordination from application owners if this service is integral to their products. The immediate first step is to identify all instances of this service, determine their exposure and criticality, and then plan remediation.

Platform/infrastructure teams own this issue.
Verify service exposure and business criticality.
Plan remediation or deploy compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is openlabs docker-wkhtmltopdf-aas?

It is a containerized microservice that provides an API for converting HTML documents into PDF files. Developers typically deploy this software to integrate document generation capabilities directly into their web applications or internal workflows.

What does OS command injection mean for CVE-2026-36576?

This vulnerability, classified as CWE-78, occurs when software fails to properly sanitize user-provided data before passing it to the system's command shell. Because of this, an attacker can append their own malicious commands to a legitimate request, tricking the server into running unauthorized instructions with the same privileges as the application.

How does an attacker trigger this vulnerability?

The flaw is triggered by sending a specifically crafted POST request to the application's API endpoint. The vulnerability relies on the application's improper processing of this input; therefore, standard, non-malicious HTML-to-PDF conversion requests do not trigger the bug.

Is my instance of this service likely at risk?

Halo Surface Signal notes that since this service is built as an Application as a Service (AAS), it is frequently deployed in internet-facing environments to process external traffic. If your instance is reachable from the public internet, it faces a higher likelihood of being accessible to unauthorized actors compared to services restricted to a private, internal network.

How should I respond to this threat?

Start by identifying all active deployments of this container within your infrastructure. Once located, verify their network accessibility and determine if the service is business-critical. Work with your platform or infrastructure teams to restrict access where possible while you plan for necessary updates or implement compensating security controls to mitigate the risk of command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.