textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
References
| Link | Resource |
|---|---|
| https://github.com/dbashford/textract | Product |
| https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js | Product |
| https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js | Product |
| https://github.com/dbashford/textract/blob/master/lib/util.js | Product |
| https://github.com/zebbernCVE/CVE-2026-26831 | Exploit Third Party Advisory |
| https://www.npmjs.com/package/textract | Product |
Configurations
History
30 Mar 2026, 13:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dbashford:textract:*:*:*:*:*:node.js:*:* | |
| First Time |
Dbashford textract
Dbashford |
|
| CWE | CWE-78 | |
| References | () https://github.com/dbashford/textract - Product | |
| References | () https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js - Product | |
| References | () https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js - Product | |
| References | () https://github.com/dbashford/textract/blob/master/lib/util.js - Product | |
| References | () https://github.com/zebbernCVE/CVE-2026-26831 - Exploit, Third Party Advisory | |
| References | () https://www.npmjs.com/package/textract - Product |
Information
Published : 2026-03-25 16:16
Updated : 2026-03-30 13:33
NVD link : CVE-2026-26831
Mitre link : CVE-2026-26831
CVE.ORG link : CVE-2026-26831
JSON object : View
Products Affected
dbashford
- textract