{"id":"CVE-2026-107802","summary":"SumatraPDF — Windows command-line argument injection in AI selection-translate","details":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","aliases":["GHSA-xvxg-cwmx-hr7j"],"modified":"2026-10-10T13:03:09.712263921Z","published":"2026-10-08T22:36:36.409Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107802.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-88"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107802.json"},{"type":"ADVISORY","url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-xvxg-cwmx-hr7j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107802"},{"type":"FIX","url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sumatrapdfreader/sumatrapdf","events":[{"introduced":"0"},{"fixed":"6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"last_affected":"3.6.1"}]}}],"versions":["3.2","3.1.2rel","3.0split","2.5split","2.4split","2.3split","2.2split","2.1split","2.0split","1.9split","1.8split","1.7split","1.6split","1.5split","1.4split"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107802.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/SelectionTranslate.cpp","function":"BuildCodexTranslateCmdLineTemp"},"deprecated":false,"digest":{"length":954,"function_hash":"225413628470954640670305747786000222463"},"id":"CVE-2026-107802-036282df","signature_type":"Function"},{"id":"CVE-2026-107802-45f0eeef","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/AIChatPanel.cpp"},"deprecated":false,"digest":{"line_hashes":["22488041493375509533814027291946885264","234946122957949372878643027814146057270","47305640170015910024439354649997589637","98169108744075861600388971716787752049","152609346174182961891350649568279497950"],"threshold":0.9}},{"digest":{"length":575,"function_hash":"186577101831838927725060007185792784674"},"id":"CVE-2026-107802-5fd105a9","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"function":"QuoteCmdLineArgTemp","file":"src/base/CmdLineArgsIter.cpp"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["177210921663098307131550233424035746881","153921972041205893751687217283967229506","284576554730554872361303640484304727973","244004052002139990330933519682058851756","73505335136333774095810937633891545005","331777786207400400435323855872051331465"]},"id":"CVE-2026-107802-755ef99f","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/base/tests/Win_ut.cpp"}},{"id":"CVE-2026-107802-82eb0101","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/AIChatPanel.cpp","function":"SendAIChatMessage"},"deprecated":false,"digest":{"function_hash":"123247576157093242478143317104851641457","length":2787}},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/GrokBuild.cpp"},"deprecated":false,"digest":{"line_hashes":["160378244179925671988611778148000829356","231772383515079265980376187519631876445","48918610180661101602983411866067661342","324368905035990161590522768641140819438","176786732535283246765018339923792125168","189911422127799130578328007642889428324","297377883436136391832929810490810624869","21478414917331766008353610830285823448","251454336290607973830607580710233769557","138908287615834241500672105679039002613","30250711128714267056378287007162992324","91709996116946703101207352416125879669","295339409495136024764820321942754734797","305576984799058937376292719316409611693"],"threshold":0.9},"id":"CVE-2026-107802-947b7872","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/SelectionTranslate.cpp","function":"BuildClaudeTranslateCmdLineTemp"},"deprecated":false,"digest":{"function_hash":"279354650990701232218532376846372450091","length":567},"id":"CVE-2026-107802-97497551","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["61823519105115673293889720232211594848","30948275007579787618796279239309257728","160326143762232975895993595325226884003","108264968854522126804996358153147119073","275187496393853162874919620454519672635","334691730566078471084520870822046020648","108095488694897547019883794466332701487","234298162167958484348784868262561746090","254280505868715439219570267115748650642","87232192408088430938873344423172778508","196514598884829859497017741558268268101","16847338765725632539821005649698873760","235979883550388847885788706341665436461","198381833872166014971835531405636031763","68655249083100943749135738733484358045","141943048792139182489014410801758089009","293241766352709624142035685260974318675","197496727437578561790304682951553168356","13854885124009547952649196782691644057","271001356462887517846144780137450409280","295867895506894464600919183519889155452","40384204276759332442933752793257107875","145777552382373439815167420859191560568","150568543821659078129527121530973715129","104718888379847733024072420988041981918","89368693240350042097957670101190643068","170076755196832621597995628615910542250","222725577364190392643701952043155106716","308194957543716507575456244762040947432"],"threshold":0.9},"id":"CVE-2026-107802-a098675b","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/base/CmdLineArgsIter.cpp"}},{"id":"CVE-2026-107802-b8a553e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/SelectionTranslate.cpp"},"deprecated":false,"digest":{"line_hashes":["186431075096505300775806106514220612723","244749995503180933483968685862768806905","182986309614494485158473678353570595686","6970810291832499691281818768378302011","271201547709388555698401496584759756309","219506812804648395322111725795393491617","149762033091640539096616779860830450001","6432915747757976937217542221121701747","258641395594389377064202319395645104671","289928573679240495759387989197093869583","211609500832849449482713460362084109734","208687724922850418312837147466256319054","62965818121850614452483187111117067467","304298369389763968307808008547105928992","55942939814721989866999317480309508226","314182300129891482970324035518088728663","103060551868635231852967364665768091573","230577630020857186464038071789232812830","196181037394247097314982182615553219532","131209323424963590167231029303031930584","118524746965900129212087571577080825962","90411931398629572974500600984705214577","135528113523021179006056794130481828676","71519698633328731058679472320732121013","174202435551418862142974894643534719911","186121905533276293625842412485613125345","73778155243758139683630918262165379468","284134909671278959568141959206377982716","104366825282744190101176473740537110231","212701162170231583403093403499996564897","125030337577563798193090736302496599648","238274926996084642205343759243268517328","332473468285526066276726400666402732222","337424283928946175991553198086205084059","63825233913915540362489137445332000240"],"threshold":0.9}},{"digest":{"line_hashes":["160378244179925671988611778148000829356","148434819611045899477340784330776054817","264509935566349525890900157989668612210","219012159166803027873128411304290791270","90899039763677380107610642270840648875","191980167100306495378784735903137547572","191630488926413888404051315360871598692","238349833703349532833127126476320121155","90966220368982230194189863623965677533","93582294481425344295054631933009570769","301889135110230818296681827977967152693","263428586386038446404798776298274039623","273124192681181794538517851196781310438","115282327125129804037250593301382316845","50342614819375961169383543206926004190","219236666963645453099420455078120543824","88245041347581500745382860880488831076"],"threshold":0.9},"id":"CVE-2026-107802-c4ff2842","signature_type":"Line","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/ClaudeCode.cpp"},"deprecated":false},{"target":{"function":"BuildGrokTranslateCmdLineTemp","file":"src/SelectionTranslate.cpp"},"deprecated":false,"digest":{"function_hash":"254456131858141157466808886189227746025","length":539},"id":"CVE-2026-107802-cca31fc9","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6"},{"signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/CodexBuild.cpp"},"deprecated":false,"digest":{"line_hashes":["160378244179925671988611778148000829356","99976000960808001068936298090011669661","242346021633334790668927867622636457866","50079789835734765215632011135684157460","337396057309321482293093740349339485127","300344223124505001738305376530291384974","92948788997383016927651989900136513501","182969244661456255594611122854609795099","14751164466513041836307375700891864472","319152379587695526324131018774045842321","70630878466205163394297909476979225325","27391816873082301603989028877813289971","282466714285013620600932333204263668453","22699443353970261313568600849060453046","99186668021986450003016754309896566806","330277346732017549913486900393217362724","34829508267695460108943389384205961303","265131145208640173057946130386342691228","84450430552672330325136560160941149475"],"threshold":0.9},"id":"CVE-2026-107802-dc994158","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"77023578790289835323781364288801075871","length":1662},"id":"CVE-2026-107802-f68545ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6","target":{"file":"src/base/tests/Win_ut.cpp","function":"WinUtilTest"}}],"vanir_signatures_modified":"2026-10-10T13:03:09Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}