CVE-2026-107802: high-severity vulnerability in sumatrapdfreader sumatrapdf
SumatraPDF — Windows command-line argument injection in AI selection-translate
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.2%
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
sumatrapdfreader · sumatrapdfRelated CVEs — sumatrapdfreader sumatrapdf
In the same product, most dangerous first.
CVE-2026-25961HIGHSumatraPDF Update MITM -> Arbitrary Code ExecutionEPSS 0.4%CVE-2026-25920MEDIUMSumatraPDF has a heap out-of-bounds read in MOBI HuffDic decompressorEPSS 0.3%CVE-2026-23512HIGHSumatraPDF has an Untrusted Search Path in sumatrapdf/src/AppTools.cppEPSS 0.2%CVE-2026-25880HIGHUntrusted Search Path in SumatraPDF Reader (explorer.exe on Windows)EPSS 0.2%CVE-2026-23951MEDIUMSumatraPDF's Integer Underflow in PalmDbReader Leads to CrashEPSS 0.2%CVE-2026-26054MEDIUMSumatraPDF: Heap out-of-bounds read in MOBI header parser.EPSS 0.2%