{"id":"CVE-2026-110638","published":"2026-10-14T15:17:16.997","lastModified":"2026-10-16T19:03:18.127","description":"doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/zepspaiva/doc-recog","tags":[]},{"url":"https://github.com/zepspaiva/doc-recog/blob/96d31957fbc2a31f1d739e2d64e5c85a05f688ec/docdata.js#L69-L74","tags":[]},{"url":"https://github.com/zepspaiva/doc-recog/pull/2","tags":[]},{"url":"https://www.vulncheck.com/advisories/doc-recog-through-1.1.6-os-command-injection-via-docdata-readpdf-file-path","tags":[]}],"exploitRefs":[{"url":"https://github.com/zepspaiva/doc-recog","tags":[]},{"url":"https://github.com/zepspaiva/doc-recog/blob/96d31957fbc2a31f1d739e2d64e5c85a05f688ec/docdata.js#L69-L74","tags":[]},{"url":"https://github.com/zepspaiva/doc-recog/pull/2","tags":[]}],"hasPoc":true,"ai":{"summary":"The doc-recog library has an OS command injection vulnerability that allows attackers to execute arbitrary commands on the system by manipulating document paths. This is critical because it can lead to full system compromise when the library processes user-supplied file paths.","exploitability":"Exploitation is straightforward with no special preconditions needed, as attackers can simply embed command substitution syntax in file paths to trigger command execution.","blast_radius":"The impact could be severe across all systems using doc-recog 1.1.6 or earlier, potentially allowing attackers to execute arbitrary commands with the privileges of the Node.js process, leading to complete system compromise.","remediation":"Upgrade to version 1.1.7 or later to fix the OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","nodejs","pdf-processing"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:48:52.563Z"}}