CVE-2026-110638 in doc-recog
Summary
by MITRE • 10/15/2026
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within doc-recog versions through 1.1.6 represents a critical OS Command Injection flaw that stems from improper validation and sanitization of user-supplied input before its use in system-level operations. Specifically, the functions recog() and tag(), which are designed to process document recognition tasks, accept file paths as arguments without adequately stripping or escaping special shell metacharacters. This architectural oversight allows an attacker who can control the file path parameter to inject arbitrary operating system commands into the execution context of the application. The core technical flaw lies in how the internal method DocData._readPDF handles these inputs; it directly passes the unsanitized document path string to a shell-based invocation of pdftotext, which is an external utility used for extracting text from PDF documents.
When the application executes this command, it relies on a system call that interprets the input through a standard POSIX-compliant shell environment rather than executing the binary directly with fixed arguments. This distinction is crucial because shells interpret specific characters such as dollar signs followed by parentheses $(...) and backticks `...` as indicators for command substitution. By embedding these sequences within the crafted file path, an attacker can effectively terminate the intended pdftotext argument and append additional commands that will be executed by the shell prior to or in conjunction with the original utility call. This mechanism bypasses any superficial checks on the filename itself because the injection occurs at the parsing level of the command line string constructed by Node.js before it is handed off to the operating system kernel for execution.
The operational impact of this vulnerability is severe, as it grants attackers the ability to execute arbitrary commands with the same privileges as the user account running the Node.js process. In many deployment scenarios, web applications or document processing services run with elevated permissions to access necessary files and resources. Consequently, successful exploitation can lead to a complete compromise of the underlying host system. Attackers could use this capability to exfiltrate sensitive data stored on the server, install backdoors for persistent access, pivot into other parts of the internal network, or disrupt service availability by terminating critical processes or consuming excessive system resources through denial-of-service techniques initiated via command execution.
This vulnerability aligns with Common Weakness Enumeration (CWE) ID 78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. From a tactical perspective within the MITRE ATT&CK framework, this flaw facilitates initial access and privilege escalation techniques where adversaries leverage command injection to execute malicious payloads directly on the target system. The attack vector is typically classified under Input Validation failures, specifically CWE-20 Improper Input Validation, as the application fails to reject or properly encode dangerous input sequences that have special meaning in the execution environment.
To mitigate this vulnerability, developers must immediately update doc-recog to a patched version where these functions enforce strict allow-listing of valid file path characters and sanitize any potentially harmful shell metacharacters. Alternatively, if updating is not feasible, the code should be refactored to avoid using shell-based command execution entirely. Instead, the application should invoke pdftotext directly using Node.js child process APIs that do not spawn a shell interpreter, such as execFile or spawn with an array of arguments rather than a single concatenated string. This approach ensures that file paths are treated strictly as data parameters and never interpreted as executable commands by the operating system shell. Additionally implementing input validation routines that reject any path containing characters like $, `, ;, &, |, or newlines can provide a secondary layer of defense against similar injection attempts in other parts of the application logic.