CVEvulnerability
CVE-2026-26831
9.8 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-03-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78, CWE-94
Description
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Affected configurations
• dbashford textract (<= 2.5.0)
Related
References
- https://github.com/dbashford/textract Product
- https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js Product
- https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js Product
- https://github.com/dbashford/textract/blob/master/lib/util.js Product
- https://github.com/zebbernCVE/CVE-2026-26831 Exploit, Third Party Advisory
- https://www.npmjs.com/package/textract Product