CVE-2026-110647: Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Anyone who runs Turnpress convert or create on a .docx file whose filename is attacker-controlled is exposed. Commands execute with the privileges of the user running Turnpress.
What does an attacker need to exploit this issue?
The attacker needs to supply a .docx file with shell metacharacters in its filename and induce the victim to process it using the convert or create operation. No authentication or elevated privileges are required, but user interaction is required.
Are default Turnpress installations affected?
Turnpress versions through 0.4.2 are affected when the convertDocxToHtml path is used by convert or create. The vulnerable behavior is caused by invoking pandoc with shell:true.
What can be done if an update is not immediately available?
Do not process untrusted .docx files, and rename files to safe filenames that contain no shell metacharacters before running convert or create. Run Turnpress with the least privileges possible to limit the impact of command execution.