QwikSec

Security Database

CVE

CWE

Training

CVE-2026-26831

Published: Mar 25, 2026

Modified: Mar 28, 2026

PUBLISHED

Description

textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://www.npmjs.com/package/textract

https://github.com/dbashford/textract

https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js

https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js

https://github.com/dbashford/textract/blob/master/lib/util.js

https://github.com/zebbernCVE/CVE-2026-26831

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.