EXPOSURES › CVE-2026-110638
CVE-2026-110638
CRITICALdoc-recog 1.1.6 allows remote OS command injection via crafted document paths in recog() or tag() functions.
An attacker can embed command substitution in file paths passed to DocData._readPDF, which executes them via a shell-based pdftotext call with Node.js process privileges. This enables remote code execution, violating CMMC/NIST 800-171 requirements for preventing unauthorized access and ensuring system integrity. DIB organizations must patch this immediately and audit similar unvalidated input handling in document processing pipelines.
Shame score — A critical OS command injection flaw in a document recognition library allows remote attackers to execute arbitrary commands, representing a severe avoidable failure in input validation and secure coding practices.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.