CVE-2026-26831

textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/dbashford/textract	Product
https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js	Product
https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js	Product
https://github.com/dbashford/textract/blob/master/lib/util.js	Product
https://github.com/zebbernCVE/CVE-2026-26831	Exploit Third Party Advisory
https://www.npmjs.com/package/textract	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:dbashford:textract:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-03-25 16:16

Updated : 2026-06-17 10:26

NVD link : CVE-2026-26831

Mitre link : CVE-2026-26831

CVE.ORG link : CVE-2026-26831

JSON object : View

Products Affected

dbashford

textract

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-26831", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26831", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-28T01:11:51.578510Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-03-25T16:16:21.123", "references": [{"url": "https://github.com/dbashford/textract", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/dbashford/textract/blob/master/lib/util.js", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/zebbernCVE/CVE-2026-26831", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.npmjs.com/package/textract", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization"}, {"lang": "es", "value": "textract hasta la versi\u00f3n 2.5.0 es vulnerable a la Inyecci\u00f3n de Comandos del Sistema Operativo a trav\u00e9s del par\u00e1metro de ruta de archivo en m\u00faltiples extractores. Al procesar archivos con nombres de archivo maliciosos, la ruta de archivo (filePath) se pasa directamente a child_process.exec() en lib/extractors/doc.js, rtf.js, dxf.js, images.js y lib/util.js con una sanitizaci\u00f3n inadecuada."}], "lastModified": "2026-06-17T10:26:21.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dbashford:textract:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "9DD5E682-185B-4FC0-AA02-650FC0C89BA1", "versionEndIncluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}