CVE-2026-26831CRITICAL 9.8EPSS p82.0%
CVE-2026-26831CVE-2026-26831
Description
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Scoring
| CVSS 3.1 | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.42% probability of exploitation · percentile 82.0% · 2026-06-18T12:00:27Z |
| Published | 2026-03-25 |
| Last modified | 2026-03-30 |
Underlying weaknesses· 2
References
- https://github.com/dbashford/textract
- https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js
- https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js
- https://github.com/dbashford/textract/blob/master/lib/util.js
- https://github.com/zebbernCVE/CVE-2026-26831
- https://www.npmjs.com/package/textract
2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')cwe-78 | 0% | live |
| Weakness | Improper Control of Generation of Code ('Code Injection')cwe-94 | 0% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.