GitHub Advisoryadvisory · npm
GHSA-9pcj-m5rr-p28g textract is vulnerable to OS Command Injection
CRITICAL
Official page ↗
- Aliases
- CVE-2026-26831
- Ecosystem
- npm
- Packages
- textract
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78, CWE-94
- Reviewed
- 2026-03-31
Affected packages
• npm textract: <= 2.5.0 (no fix yet)
Description
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Related
Alias · CVE (1)
- CVE-2026-26831 textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-26831 advisory
- https://github.com/dbashford/textract package
- https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js web
- https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js web
- https://github.com/dbashford/textract/blob/master/lib/util.js web
- https://github.com/zebbernCVE/CVE-2026-26831 web
- https://www.npmjs.com/package/textract web