CVE-2026-26831

🗓️ 25 Mar 2026 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 11 Views🌐 WEB

CVE-2026-26831: textract up to 2.5.0 allows OS command injection via filePath in extractors.

Reporter	Title	Published	Views	Family All 15
GithubExploit	Exploit for CVE-2026-26831	24 Mar 202616:15	–	githubexploit
CNNVD	textract 安全漏洞	25 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-26831	25 Mar 202600:00	–	cvelist
EUVD	EUVD-2026-15459	25 Mar 202618:31	–	euvd
Github Security Blog	textract is vulnerable to OS Command Injection	25 Mar 202618:31	–	github
NVD	CVE-2026-26831	25 Mar 202616:16	–	nvd
OSV	GHSA-9PCJ-M5RR-P28G textract is vulnerable to OS Command Injection	25 Mar 202618:31	–	osv
Packet Storm	📄 textract 2.5.0 Command Injection	26 Mar 202600:00	–	packetstorm
Packet Storm	📄 textract 2.5.0 Command Injection	27 Apr 202600:00	–	packetstorm
Positive Technologies	PT-2026-27800	25 Mar 202600:00	–	ptsecurity

NVD

Node

dbashford textractRange≤2.5.0node.js

Source	Link
npmjs	www.npmjs.com/package/textract
github	www.github.com/dbashford/textract
github	www.github.com/dbashford/textract/blob/master/lib/extractors/rtf.js
github	www.github.com/dbashford/textract/blob/master/lib/util.js
github	www.github.com/dbashford/textract/blob/master/lib/extractors/doc.js
github	www.github.com/zebbernCVE/CVE-2026-26831

Parameter	Position	Path	Description	CWE
filePath	path	lib/extractors/doc.js	OS command injection via unsafely concatenated filePath into shell command in textract extractors	CWE-78, CWE-94

17 Jun 2026 10:26Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.02421

SSVC