CVE-2026-41553 is a critical remote code execution flaw (CVSS 10.0) in the DHTMLX PDF Export Module used with Gantt and Scheduler. An unauthenticated caller can send JavaScript in the data parameter that Node.js then runs. The record says the fix is module version 0.7.6.
What's affected
The NVD record says the issue was fixed in PDF Export Module version 0.7.6, and the DHTMLX documentation linked from it lists the fix for remote code execution and file read in the 0.7.6 notes. The CERT Polska advisory lists the vulnerable range as 0.3.3 to 0.7.6, which does not match cleanly. Read both and confirm the exact fixed build with DHTMLX before you rely on it.
The same CERT Polska notice covers related issues: CVE-2026-41552, a path traversal in the same module, and CVE-2026-7182, a path traversal in the Diagram export module.
How to check if you're exposed
This is a server side component that you run yourself. Find out whether your Gantt or Scheduler deployment uses a self hosted export service:
grep -R "export" package.json
docker ps | grep -i export
Look for the PDF export module in your deployment manifests, and read its version. If the application posts to DHTMLX's own hosted export endpoint instead, the issue applies to your own deployed service, not to theirs.
Check whether the export endpoint is reachable from the internet. An open export service is the dangerous case.
What to do now
- Upgrade the PDF Export Module to 0.7.6 or later, and confirm the build number with DHTMLX.
- Do not expose the export service to the internet, and require authentication in front of it.
- Run the service in a container with a low privilege user and no access to secrets.
- Review logs for unusual requests to the export endpoint.
- Also apply the fixes for CVE-2026-41552 and CVE-2026-7182 if you use those modules.
Why it matters
The record lists CWE-78, OS command injection, as the class, and the description says a lack of sanitization of the data parameter lets script content be processed by Node.js and executed. The scope changed in the CVSS vector, reflecting impact beyond the vulnerable component.
Export and rendering services are often forgotten: they take structured input and hand it to a headless renderer or interpreter. Treat them like any code running service. Keep them off the public internet, and keep secrets out of reach. The record does not flag this CVE as known exploited.
Quick check
Is the DHTMLX Gantt library itself vulnerable?
The record names the PDF Export Module. Check what you run for your Gantt or Scheduler export.
Sources
Last reviewed: 19 October 2026.
