CVE-2026-26831: textract is vulnerable to OS Command Injection
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to childprocess.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Published Mar 25, 2026 · Updated Mar 31, 2026
Affected packages
textract
- Ecosystem
- npm
- Affected
- <= 2.5.0
- Fixed in
- No patched version yet
- Check
npm ls textract
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-26831
- https://github.com/dbashford/textract
- https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js
- https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js
- https://github.com/dbashford/textract/blob/master/lib/util.js
- https://github.com/zebbernCVE/CVE-2026-26831
- https://www.npmjs.com/package/textract
- https://github.com/advisories/GHSA-9pcj-m5rr-p28g
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology