CVE-2026-41553

Critical

Description

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise. This issue was fixed in PDF Export Module version 0.7.6.

SeverityCritical

CVSS10.0

Exploit probability—

Product

Dhtmlx Pdf Export Module

PublishedMay 15, 2026

First seenMay 15, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

dhtmlx pdf_export_module0.7.6 or later

Vendor advisories

docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076:~:text=Fixed%20Remote%20Code%20Execution%20and%20File%20Read%20vulnerabilities

Affected products

Product	Affected versions	Fixed in
dhtmlx pdf_export_module	v < 0.7.6	0.7.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.