Description

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:16.997Z",
  "pubdate": "2026-10-14T15:17:16.997Z",
  "executiveSummary": "The doc-recog package, versions through 1.1.6, is susceptible to an OS command injection vulnerability. This flaw arises from improper sanitization of user-supplied input when processing document paths within the application's file-handling routines. By injecting malicious command substitution syntax, such as $(...) or backticks, an unauthenticated attacker can coerce the underlying Node.js process to execute arbitrary shell commands.\nThe vulnerability resides in the interaction between the DocData._readPDF internal method and the system-level pdftotext binary. Because the application passes unsanitized file paths directly to a shell-based execution context, the system treats the malicious input as part of the command string rather than a literal file path. This provides an attacker with the ability to execute commands with the same privilege level as the Node.js process, potentially leading to unauthorized system access, data exfiltration, or complete compromise of the host environment. Given that no authentication is required to interact with the vulnerable functions, this represents a high-risk security flaw that necessitates immediate attention.",
  "technicalDetails": "The root cause of this vulnerability is a failure to implement input validation or shell-escaping mechanisms when constructing command strings for subprocess execution. Specifically, the affected component, DocData._readPDF, handles document paths provided to the recog() or tag() functions. The implementation uses a shell-invoking method (likely exec() or a similar wrapper) to call the external pdftotext utility for PDF processing.\nThe exploitation flow begins when an attacker provides a crafted string as the document path. Instead of providing a legitimate file path, the attacker embeds command substitution sequences such as $(command) or backticks (`command`). Because the application performs direct concatenation of this input into the shell command string, the shell interprets the embedded content as executable instructions. For example, a path constructed as '/path/to/file.pdf$(whoami)' results in the shell executing the 'whoami' command prior to or alongside the intended pdftotext call.\nThe vulnerability affects all versions of doc-recog up to and including 1.1.6. The exploitation is trivial, requiring no prior authentication, and is effective as long as the attacker can control the input string passed to the affected functions. Since the execution occurs within the context of the Node.js runtime, the payload executes with the privileges assigned to the Node.js process. Consequently, if the process is running with elevated or service-level permissions, the attacker inherits those rights, facilitating lateral movement, persistence establishment, or unauthorized file access. The reliance on shell-based execution is the primary driver of this flaw, as it exposes the runtime environment to the full capabilities of the underlying operating system shell, circumventing the intended constraints of the application's logic."
}