CVE-2026-110638: doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData.readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
What input must an attacker control to exploit this issue?
An attacker must be able to supply a crafted document file path to the recog() or tag() function. Paths containing $(...) or backtick command substitution can cause commands to run.
What privileges do injected commands receive?
Injected commands run with the privileges of the Node.js process executing doc-recog. The vulnerability can therefore affect the confidentiality, integrity, and availability of resources accessible to that process.
Which versions are known to be affected?
doc-recog through version 1.1.6 is affected. No fixed version is identified in the provided information.