Does anyone know if this this an actual feature implemented in Heroku or is it an open vulnerability? I'm not finding any documentation on this command.

I can't imagine it's considered a vulnerability. Heroku has had a documented `heroku console` that can do at least as much as bash can, security-wise.

Ah, I totally forgot about heroku console.

Had this exact same issue. xpdf isn't on the new cedar stack.

Not ideal, but you can package up a rubygem that can compile itself. https://github.com/josh/ruby-xpdf

We thought about doing it this way and opted for the other since it was quick and easy. Great to see your implementation though, may end up just using it :)