CVE-2026-110638
9.8CriticalPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Attackers can run arbitrary shell commands with Node.js process privileges by supplying malicious file paths containing shell substitutions. This requires only that user-controlled input reaches the recog() or tag() functions without prior authentication.
Root cause
The DocData._readPDF function interpolates document file paths directly into a shell-executed pdftotext command without sanitization.
Affected systems
doc-recog through 1.1.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed release is currently listed; check the upstream repository for merged patches. Until a patch is published, strictly validate or reject document paths containing shell metacharacters before calling recog() or tag(), or stop passing untrusted file paths to the library.
$ npm list doc-recogAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.