What’s Vulnerable › Vulnerabilities

CVE-2026-85672: zerox 1.1.20 OS Command Injection via Document URL File Extension

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-23
• Weakness: CWE-78

Description

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.

Affected products

• getomni-ai zerox: through 1.1.20

References

• https://github.com/getomni-ai/zerox
• https://github.com/getomni-ai/zerox/blob/main/node-zerox/src/utils/file.ts
• https://github.com/getomni-ai/zerox/issues/206
• https://www.vulncheck.com/advisories/zerox-1.1.20-os-command-injection-via-document-url-file-extension
• https://github.com/getomni-ai/zerox/issues/206

Get alerted when CVE-2026-85672 or the next vulnerability affects your stack