microsoft/markitdown · critical · RuntimeError

ExifTool version {version_output} is vulnerable to CVE-2021-

Error message

ExifTool version {version_output} is vulnerable to CVE-2021-22204. Please upgrade to version 12.24 or later.

What it means

MarkItDown shells out to the external exiftool binary to extract image metadata, and before running it verifies the installed version. ExifTool versions below 12.24 are vulnerable to CVE-2021-22204, a critical remote code execution via crafted metadata, so the code explicitly refuses to proceed and asks you to upgrade. This is a deliberate security guard, not a parsing failure.

Source

Thrown at packages/markitdown/src/markitdown/converters/_exiftool.py:31

    *,
    exiftool_path: Union[str, None],
) -> Any:  # Need a better type for json data
    # Nothing to do
    if not exiftool_path:
        return {}

    # Verify exiftool version
    try:
        version_output = subprocess.run(
            [exiftool_path, "-ver"],
            capture_output=True,
            text=True,
            check=True,
        ).stdout.strip()
        version = _parse_version(version_output)
        min_version = (12, 24)
        if version < min_version:
            raise RuntimeError(
                f"ExifTool version {version_output} is vulnerable to CVE-2021-22204. "
                "Please upgrade to version 12.24 or later."
            )
    except (subprocess.CalledProcessError, ValueError) as e:
        raise RuntimeError("Failed to verify ExifTool version.") from e

    # Run exiftool
    cur_pos = file_stream.tell()
    try:
        output = subprocess.run(
            [exiftool_path, "-json", "-"],
            input=file_stream.read(),
            capture_output=True,
            text=False,
        ).stdout

        return json.loads(
            output.decode(locale.getpreferredencoding(False)),

View on GitHub (pinned to fd239d5d2b)

Solutions

1. Upgrade exiftool to >= 12.24 (e.g. brew upgrade exiftool, apt install newer version from backports, or download the official release from exiftool.org)
2. On Debian/Ubuntu where the distro package is old, install the Perl source distribution: cpan Image::ExifTool, or use the standalone exiftool executable from exiftool.org placed on PATH
3. In Dockerfiles, replace apt exiftool with a pinned download: install from exiftool.org or use a base image shipping a recent version
4. Verify after upgrading: exiftool -ver # must print 12.24 or higher

Example fix

# before (Dockerfile)
RUN apt-get update && apt-get install -y exiftool  # 11.x on older distros -> CVE guard triggers

# after
RUN apt-get update && apt-get install -y libimage-exiftool-perl || true \
    && wget https://exiftool.org/Image-ExifTool-12.76.tar.gz \
    && tar -xzf Image-ExifTool-12.76.tar.gz \
    && cd Image-ExifTool-12.76 && perl Makefile.PL && make install

import subprocess

def exiftool_is_safe(min_version=(12, 24)) -> bool:
    try:
        out = subprocess.run(["exiftool", "-ver"], capture_output=True, text=True, check=True).stdout.strip()
        return tuple(int(p) for p in out.split(".")[:3]) >= min_version
    except Exception:
        return False

try:
    result = MarkItDown().convert("photo.jpg")
except RuntimeError as e:
    if "CVE-2021-22204" in str(e):
        logger.error("exiftool %s is vulnerable; upgrade to >= 12.24", str(e))
        raise

When it happens

Trigger: Converting an image (EXIF/XMP metadata extraction path) on a machine where `exiftool -ver` reports a version whose parsed tuple is less than (12, 24). Typical with exiftool from old distro repositories (e.g. Ubuntu 20.04 ships 11.x) or an outdated Homebrew/Chocolatey install.

Common situations: CI images based on Debian/Ubuntu LTS with apt-pinned exiftool; macOS with an old Homebrew exiftool; Windows with a manually downloaded exiftool zip never updated; air-gapped environments that cannot upgrade system packages easily.

Related errors

• Failed to verify ExifTool version.

AI-assisted analysis of microsoft/markitdown@fd239d5d2b (2026-08-14). Data as JSON: /api/errors/dd2dcf12e9dcf6fc. Report an issue: GitHub.