Nixpkgs security tracker
3.3 LOW
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): LOW
- Availability impact (A): NONE
MuPDF mutool ANSI Injection via Metadata
MuPDF mutool does not sanitize PDF metadata fields before writing them to terminal output, allowing attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to the terminal when running mutool info, enabling them to clear the terminal display and render arbitrary text for social engineering attacks such as presenting fake prompts or spoofed commands.
References
Affected products
- <0f17d789fe8c29b41e47663be82514aaca3a4dfb
Matching in nixpkgs
pkgs.mupdf
Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C
pkgs.mupdf-headless
Lightweight PDF, XPS, and E-book viewer and toolkit written in portable C
pkgs.python312Packages.pymupdf
Python bindings for MuPDF's rendering library
pkgs.python313Packages.pymupdf
Python bindings for MuPDF's rendering library
pkgs.python314Packages.pymupdf
Python bindings for MuPDF's rendering library
pkgs.python312Packages.pymupdf4llm
PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation
-
nixos-25.11 pymupdf4llm-0.0.27
- nixos-25.11-small pymupdf4llm-0.0.27
- nixpkgs-25.11-darwin pymupdf4llm-0.0.27
pkgs.python313Packages.pymupdf4llm
PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation
-
nixos-unstable pymupdf4llm-0.3.4
- nixpkgs-unstable pymupdf4llm-0.3.4
- nixos-unstable-small pymupdf4llm-0.3.4
-
nixos-25.11 pymupdf4llm-0.0.27
- nixos-25.11-small pymupdf4llm-0.0.27
- nixpkgs-25.11-darwin pymupdf4llm-0.0.27
pkgs.python314Packages.pymupdf4llm
PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation
-
nixos-unstable pymupdf4llm-0.3.4
- nixpkgs-unstable pymupdf4llm-0.3.4
- nixos-unstable-small pymupdf4llm-0.3.4
pkgs.zathuraPkgs.zathura_pdf_mupdf
Zathura PDF plugin (mupdf)
-
nixos-unstable 2026.02.03
- nixpkgs-unstable 2026.02.03
- nixos-unstable-small 2026.02.03
pkgs.python312Packages.pymupdf-fonts
Collection of optional fonts for PyMuPDF
pkgs.python313Packages.pymupdf-fonts
Collection of optional fonts for PyMuPDF
pkgs.python314Packages.pymupdf-fonts
Collection of optional fonts for PyMuPDF
Package maintainers
-
@fpletz Franz Pletz <fpletz@fnordicwalking.de>
-
@sarahec Sarah Clark <seclark@nextquestion.net>
-
@ryota2357 Ryota Otsuki <contact@ryota2357.com>