CVE-2026-26831 in textract
Сводка (Английский)
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Ответственный
MITRE
Резервировать
16.02.2026
Раскрытие
25.03.2026
Статус
Подтверждённый
Записи
VulDB provides additional information and datapoints for this CVE:
| ИД | Уязвимость | CWE | Экс | Кон | CVE |
|---|---|---|---|---|---|
| 353187 | textract child_process.exec эскалация привилегий | 78 | Не определено | Не определено | CVE-2026-26831 |