CVE-2026-110647 in Turnpress
Summary
by MITRE • 10/15/2026
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Turnpress versions up to 0.4.2 represents a critical OS command injection flaw rooted in improper neutralization of special elements used in an operating system shell. The core issue resides within the src/converter.ts module, specifically inside the convertDocxToHtml function which is responsible for processing Microsoft Word documents into HTML format. This function relies on the pandoc utility to perform the conversion task but executes it via the execa library with the shell option explicitly set to true. While using a shell can provide necessary flexibility for complex command chaining, it introduces significant risk when user-supplied input is directly interpolated into the command string without adequate sanitization or validation.
The attack vector exploits this configuration by allowing an attacker to supply a .docx file with a maliciously crafted filename. Because the application passes the path of this document as part of the shell command executed by pandoc, any shell metacharacters embedded within the filename are interpreted by the operating system's command interpreter rather than being treated as literal characters in the file name. This means that if an attacker names their uploaded document with a string containing commands such as semicolons, pipes, or backticks followed by arbitrary shell instructions, those instructions will be executed on the host server. The execution context is particularly dangerous because these commands run with the privileges of the victim process running Turnpress, which often implies elevated permissions depending on how the application is deployed.
From a technical perspective, this flaw aligns directly with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The failure to validate or escape special characters before passing them to the shell allows for arbitrary command execution. In terms of offensive security frameworks, this vulnerability facilitates the ATT&CK technique T1059 Command and Scripting Interpreter, specifically allowing adversaries to execute commands via system shells like sh or bash. This capability can lead to severe operational impacts including full server compromise, data exfiltration, lateral movement within the network, and potential denial of service through resource exhaustion or destructive command execution.
Mitigation strategies must focus on eliminating the direct use of shell interpreters for executing external programs whenever possible. The most effective remediation is to refactor the convertDocxToHtml function to invoke pandoc using execa without the shell option set to true, thereby passing arguments as an array rather than a single string. This approach ensures that all parameters are treated strictly as data and not as part of the command syntax, effectively neutralizing any injected metacharacters. If shell execution is absolutely necessary for specific features, strict input validation must be implemented to whitelist allowed characters in file names or paths, ensuring that only alphanumeric characters, hyphens, underscores, and periods are permitted. Additionally, implementing principle of least privilege by running the application with minimal system permissions can reduce the impact if a successful exploitation occurs. Regular security audits and static code analysis tools configured to detect unsafe shell invocations should be integrated into the development lifecycle to prevent similar issues in future releases.