[ CVE-2026-110638 · Published 14 Oct 2026 ]
Vulnerability in zepspaiva doc-recog
CVSS 9.8
EPSS 3%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.8
[ Description ]Official description
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.