by Kastro
Paper/Archive/CVE-2026-26831

CVE-2026-26831

mitre — textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
56
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.8.848 × 2017.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refnpmjs.com/package/textractrefgithub.com/dbashford/textractrefgithub.com/dbashford/textract/blob/master/lib/extractors/doc.jsrefgithub.com/dbashford/textract/blob/master/lib/extractors/rtf.jsrefgithub.com/dbashford/textract/blob/master/lib/util.jsrefgithub.com/zebbernCVE/CVE-2026-26831