VulnerabilityAnalyzed
CVE-2026-26831
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.
CRITICAL 9.8EPSS 2.42%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.42% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78, CWE-94
- Affected
- dbashford/textract
- Source
- cve@mitre.org
References
- https://github.com/dbashford/textractProduct
- https://github.com/dbashford/textract/blob/master/lib/extractors/doc.jsProduct
- https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.jsProduct
- https://github.com/dbashford/textract/blob/master/lib/util.jsProduct
- https://github.com/zebbernCVE/CVE-2026-26831Exploit, Third Party Advisory
- https://www.npmjs.com/package/textractProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.