What’s Vulnerable › Vulnerabilities

CVE-2026-110638: doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-16
• Weakness: CWE-78

Description

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.

Affected products

• zepspaiva doc-recog: through 1.1.6

References

• https://github.com/zepspaiva/doc-recog
• https://github.com/zepspaiva/doc-recog/blob/96d31957fbc2a31f1d739e2d64e5c85a05f688ec/docdata.js#L69-L74
• https://github.com/zepspaiva/doc-recog/pull/2
• https://www.vulncheck.com/advisories/doc-recog-through-1.1.6-os-command-injection-via-docdata-readpdf-file-path

Get alerted when CVE-2026-110638 or the next vulnerability affects your stack