Dbashford Textract vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Dbashford Textract: 1 record(s), with affected versions and fixes.
cpe:2.3:a:dbashford:textract

CVE-2026-26831 Critical · 9.8 CWE-78 Mar 25, 2026

OS Command Injection in Dbashford Textract

textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization