CVE-2026-110638: falha crítica em zepspaiva doc-recog
doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 2.7%
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
zepspaiva · doc-recogReferências
https://github.com/zepspaiva/doc-recoghttps://github.com/zepspaiva/doc-recog/blob/96d31957fbc2a31f1d739e2d64e5c85a05f688ec/docdata.js#L69-L74https://github.com/zepspaiva/doc-recog/pull/2https://www.vulncheck.com/advisories/doc-recog-through-1.1.6-os-command-injection-via-docdata-readpdf-file-path