7 matches found
CVE-2026-26831
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to childprocess.exec in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequat...
Command Injection
Overview textract is an Extracting text from files of various type including html, pdf, doc, docx, xls, xlsx, csv, pptx, png, jpg, gif, rtf, text/, and various open office. Affected versions of this package are vulnerable to Command Injection via the filePath parameter in multiple extractors. An...
@brainbase-ai/action-read (=0.0.1), @brainbase-ai/actions (>=3.2.105 <=3.2.107) +71 more potentially affected by CVE-2026-26831 via textract (>=1.1.1 <=2.5.0)
textract NPM version =1.1.1, =3.2.105, =0.0.0, =0.0.0, =0.0.0, =0.0.15, =0.0.0, =0.0.0, =0.1.0, =1.0.0, =1.0.0, =0.1.1, =0.7.0, =0.17.0 and more Source cves: CVE-2026-26831 Source advisory: SNYK:JS-TEXTRACT-15874118...
GHSA-9PCJ-M5RR-P28G textract is vulnerable to OS Command Injection
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to childprocess.exec in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequat...
CVE-2026-26831
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to childprocess.exec in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequat...
CVE-2016-10320
textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files...
Command injection
textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files...