CVE-2026-26831
Published: 25 March 2026
Description
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of filePath inputs before passing to child_process.exec to block OS command injection from malicious filenames.
Mandates timely identification, testing, and deployment of fixes for flaws like the unsanitized filePath handling in textract versions through 2.5.0.
Requires vulnerability scanning of third-party libraries like textract to detect and remediate known issues such as CVE-2026-26831 prior to exploitation.
Security SummaryAI
Textract, a Node.js library for extracting text from various document formats through version 2.5.0, contains an OS command injection vulnerability (CVE-2026-26831, CWE-78, CWE-94). The issue arises when processing files with malicious filenames, as the filePath parameter is passed directly to child_process.exec() without adequate sanitization in multiple extractor modules, including lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js. This flaw was published on 2026-03-25 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.
Remote attackers require no privileges or user interaction to exploit this vulnerability. By supplying a file with a specially crafted filename to an application using textract for document processing, an unauthenticated adversary can inject and execute arbitrary operating system commands on the host system. Successful exploitation grants high-impact control over confidentiality, integrity, and availability, potentially leading to full remote code execution.
References point to the textract GitHub repository and the specific vulnerable source files, along with a dedicated CVE details repository. Security practitioners should verify the latest textract release for remediation, as the vulnerability affects versions through 2.5.0, and update affected applications accordingly to mitigate risks.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote command injection via malicious filenames processed by the library, enabling exploitation of public-facing applications (T1190) for arbitrary OS command execution (T1059).