CVE-2026-110647

7.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Attackers can execute arbitrary shell commands with the user's privileges. They need a user to process a maliciously named .docx file using the convert or create commands.

Root cause

The convertDocxToHtml function passes unescaped docx filenames directly to pandoc via execa with shell:true enabled.

Affected systems

Turnpress through 0.4.2

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Turnpress to a version beyond 0.4.2 containing PR #2 once available, or avoid processing untrusted .docx filenames in the interim.

shell

$ npm list turnpress

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110647