{"record":{"id":"dd2dcf12e9dcf6fc","repo":"microsoft/markitdown","slug":"exiftool-version-version-output-is-vulnerable-to","errorCode":null,"errorMessage":"ExifTool version {version_output} is vulnerable to CVE-2021-22204. Please upgrade to version 12.24 or later.","messagePattern":"ExifTool version (.+?) is vulnerable to CVE-2021-22204\\. Please upgrade to version 12\\.24 or later\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"critical","filePath":"packages/markitdown/src/markitdown/converters/_exiftool.py","lineNumber":31,"sourceCode":"    *,\n    exiftool_path: Union[str, None],\n) -> Any:  # Need a better type for json data\n    # Nothing to do\n    if not exiftool_path:\n        return {}\n\n    # Verify exiftool version\n    try:\n        version_output = subprocess.run(\n            [exiftool_path, \"-ver\"],\n            capture_output=True,\n            text=True,\n            check=True,\n        ).stdout.strip()\n        version = _parse_version(version_output)\n        min_version = (12, 24)\n        if version < min_version:\n            raise RuntimeError(\n                f\"ExifTool version {version_output} is vulnerable to CVE-2021-22204. \"\n                \"Please upgrade to version 12.24 or later.\"\n            )\n    except (subprocess.CalledProcessError, ValueError) as e:\n        raise RuntimeError(\"Failed to verify ExifTool version.\") from e\n\n    # Run exiftool\n    cur_pos = file_stream.tell()\n    try:\n        output = subprocess.run(\n            [exiftool_path, \"-json\", \"-\"],\n            input=file_stream.read(),\n            capture_output=True,\n            text=False,\n        ).stdout\n\n        return json.loads(\n            output.decode(locale.getpreferredencoding(False)),","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/microsoft/markitdown/blob/fd239d5d2be43d9b68329730206b9312c7d5a388/packages/markitdown/src/markitdown/converters/_exiftool.py#L13-L49","documentation":"MarkItDown shells out to the external exiftool binary to extract image metadata, and before running it verifies the installed version. ExifTool versions below 12.24 are vulnerable to CVE-2021-22204, a critical remote code execution via crafted metadata, so the code explicitly refuses to proceed and asks you to upgrade. This is a deliberate security guard, not a parsing failure.","triggerScenarios":"Converting an image (EXIF/XMP metadata extraction path) on a machine where `exiftool -ver` reports a version whose parsed tuple is less than (12, 24). Typical with exiftool from old distro repositories (e.g. Ubuntu 20.04 ships 11.x) or an outdated Homebrew/Chocolatey install.","commonSituations":"CI images based on Debian/Ubuntu LTS with apt-pinned exiftool; macOS with an old Homebrew exiftool; Windows with a manually downloaded exiftool zip never updated; air-gapped environments that cannot upgrade system packages easily.","solutions":["Upgrade exiftool to >= 12.24 (e.g. brew upgrade exiftool, apt install newer version from backports, or download the official release from exiftool.org)","On Debian/Ubuntu where the distro package is old, install the Perl source distribution: cpan Image::ExifTool, or use the standalone exiftool executable from exiftool.org placed on PATH","In Dockerfiles, replace apt exiftool with a pinned download: install from exiftool.org or use a base image shipping a recent version","Verify after upgrading: exiftool -ver  # must print 12.24 or higher"],"exampleFix":"# before (Dockerfile)\nRUN apt-get update && apt-get install -y exiftool  # 11.x on older distros -> CVE guard triggers\n\n# after\nRUN apt-get update && apt-get install -y libimage-exiftool-perl || true \\\n    && wget https://exiftool.org/Image-ExifTool-12.76.tar.gz \\\n    && tar -xzf Image-ExifTool-12.76.tar.gz \\\n    && cd Image-ExifTool-12.76 && perl Makefile.PL && make install","handlingStrategy":"validation","validationCode":"import subprocess\n\ndef exiftool_is_safe(min_version=(12, 24)) -> bool:\n    try:\n        out = subprocess.run([\"exiftool\", \"-ver\"], capture_output=True, text=True, check=True).stdout.strip()\n        return tuple(int(p) for p in out.split(\".\")[:3]) >= min_version\n    except Exception:\n        return False","typeGuard":null,"tryCatchPattern":"try:\n    result = MarkItDown().convert(\"photo.jpg\")\nexcept RuntimeError as e:\n    if \"CVE-2021-22204\" in str(e):\n        logger.error(\"exiftool %s is vulnerable; upgrade to >= 12.24\", str(e))\n        raise","preventionTips":["Pin a modern exiftool in Dockerfiles and CI images instead of relying on distro versions","Add a startup check that exiftool -ver >= 12.24 before accepting image conversions","Subscribe to exiftool release notes and upgrade promptly; the guard exists because old versions allow RCE from malicious metadata"],"tags":["security","cve","exiftool","external-binary","version-check"],"backgroundTag":null,"analyzedSha":"fd239d5d2be43d9b68329730206b9312c7d5a388","analyzedAt":"2026-08-14T15:47:51.745Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}