doc-recog Library OS Command Injection in Path Processing
A critical flaw in doc-recog versions up to 1.1.6 allows attackers to execute system commands via crafted document file paths.
Key points
- CVE-2026-110638 affects doc-recog through version 1.1.6 with a CVSS score of 9.3.
- The vulnerability stems from passing unvalidated file paths to a shell-based pdftotext call.
- Attackers can embed command substitution sequences to run code with Node.js process privileges.
The doc-recog library contains a critical OS command injection flaw in versions up to 1.1.6, according to the National Vulnerability Database. This vulnerability allows attackers to execute arbitrary system commands by supplying crafted document paths to the recog() or tag() functions. The issue arises because the library passes these paths to a shell-based pdftotext exec call without proper sanitisation.
Root cause
The underlying weakness, classified as CWE-78, occurs within the DocData._readPDF method. This component processes file paths provided by the application and passes them directly to an external shell command. Because the input is not validated or escaped, the shell interprets special characters as executable instructions rather than literal path data.
Attack path
An attacker crafts a document path containing command substitution sequences such as $(...) or backticks. When the application calls recog() or tag() with this malicious path, the embedded commands are executed. These commands run with the same privileges as the Node.js process hosting the library, potentially compromising the host system.
Affected versions
- doc-recog version 1.1.6
- doc-recog version 1.1.5
- doc-recog version 1.1.4
- Earlier versions of the zepspaiva doc-recog package
Mitigation
- Avoid passing user-controlled inputs directly to file path arguments in doc-recog.
- Implement strict input validation for all document paths before processing.
- Sanitise any data that might contain shell metacharacters or command substitution syntax.
- Consider isolating the processing environment to limit the impact of potential command execution.
Signals worth monitoring
Security operations teams should monitor for unusual process spawns originating from Node.js applications. Check logs for unexpected pdftotext executions or shell commands triggered by file processing routines. Look for anomalous network connections initiated by application processes, which may indicate data exfiltration or further command execution. Teams usually detect this activity by correlating file access events with subsequent system command executions.
What to do and how to stay safe: doc-recog
- Review application code for direct usage of doc-recog functions with external inputs.
- Implement strict allowlists for permitted characters in file paths.
- Monitor system logs for unexpected command executions from application processes.
- Isolate application environments to limit potential damage from command injection.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-110638?
The National Vulnerability Database assigns a CVSS score of 9.3, rating it as critical.
Which functions in doc-recog are affected by this vulnerability?
The recog() and tag() functions are vulnerable when supplied with crafted document paths.
Are there any confirmed patches for this issue?
No patch or fix has been confirmed yet for this vulnerability in the source material.
