diff --git a/common/contrib/print/SA-CONTRIB-2018-063.patch b/common/contrib/print/SA-CONTRIB-2018-063.patch
new file mode 100644
index 0000000000000000000000000000000000000000..67902dcb9638b0aec8629f54830cb944bc24cd4f
--- /dev/null
+++ b/common/contrib/print/SA-CONTRIB-2018-063.patch
@@ -0,0 +1,35 @@
+diff --git a/print_pdf/print_pdf.pages.inc b/print_pdf/print_pdf.pages.inc
+index 1f1fb92..6999cb8 100644
+--- a/print_pdf/print_pdf.pages.inc
++++ b/print_pdf/print_pdf.pages.inc
+@@ -110,6 +110,9 @@ function print_pdf_generate_path($path, $cid = NULL, $pdf_filename = NULL) {
+ function print_pdf_generate_html($print, $html, $filename = NULL) {
+   $print_pdf_pdf_tool = variable_get('print_pdf_pdf_tool', PRINT_PDF_PDF_TOOL_DEFAULT);
+ 
++  // Remove all scripts due to security concerns.
++  $html = preg_replace('!<script(.*?)>(.*?)</script>!is', '', $html);
++
+   if (basename($print_pdf_pdf_tool) == 'dompdf_config.inc.php') {
+     return _print_pdf_dompdf($print, $html, $filename);
+   }
+@@ -380,8 +383,8 @@ function _print_pdf_tcpdf($print, $html, $filename = NULL) {
+  */
+ function _print_pdf_wkhtmltopdf($print, $html, $filename = NULL) {
+   $print_pdf_pdf_tool = variable_get('print_pdf_pdf_tool', PRINT_PDF_PDF_TOOL_DEFAULT);
+-  $print_pdf_paper_size = variable_get('print_pdf_paper_size', PRINT_PDF_PAPER_SIZE_DEFAULT);
+-  $print_pdf_page_orientation = variable_get('print_pdf_page_orientation', PRINT_PDF_PAGE_ORIENTATION_DEFAULT);
++  $print_pdf_paper_size = escapeshellarg(variable_get('print_pdf_paper_size', PRINT_PDF_PAPER_SIZE_DEFAULT));
++  $print_pdf_page_orientation = escapeshellarg(variable_get('print_pdf_page_orientation', PRINT_PDF_PAGE_ORIENTATION_DEFAULT));
+   $print_pdf_content_disposition = variable_get('print_pdf_content_disposition', PRINT_PDF_CONTENT_DISPOSITION_DEFAULT);
+   $print_pdf_wkhtmltopdf_options = variable_get('print_pdf_wkhtmltopdf_options', PRINT_PDF_WKHTMLTOPDF_OPTIONS);
+ 
+@@ -391,6 +394,9 @@ function _print_pdf_wkhtmltopdf($print, $html, $filename = NULL) {
+     $print_pdf_wkhtmltopdf_options = token_replace($print_pdf_wkhtmltopdf_options, 'node', $print['node'], TOKEN_PREFIX, TOKEN_SUFFIX, array('clear' => TRUE));
+   }
+ 
++  // Prevent options that could result in execution of arbitrary commands.
++  $wkhtmltopdf_options = escapeshellcmd($wkhtmltopdf_options);
++
+   $version = _print_pdf_wkhtmltopdf_version();
+ 
+   // 0.10.0 beta2 identifies itself as 0.9.9