CVE-2026-26831

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/dbashford/textractProduct
https://github.com/dbashford/textract/blob/master/lib/extractors/doc.jsProduct
https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.jsProduct
https://github.com/dbashford/textract/blob/master/lib/util.jsProduct
https://github.com/zebbernCVE/CVE-2026-26831Exploit, Third Party Advisory
https://www.npmjs.com/package/textractProduct

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-268329.8node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() funct CVE-2026-268339.8thumbler through 1.1.2 allows OS command injection via the input, output, time, or size parameter in the thumbnail() function because user i CVE-2026-26849.8A vulnerability was determined in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). The impacted element is an unknown f CVE-2026-268469.8Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the Ut CVE-2026-26869.8A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_lo CVE-2026-268618.3CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreview CVE-2026-268628.3CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Buil CVE-2026-26874.3The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2026-26886.5The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX reques CVE-2026-268832.7Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment.CVE-2026-268842.7Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view_appointment.php.CVE-2026-268852.7Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete_service.