Description

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T15:17:45.293Z",
  "pubdate": "2026-09-04T15:17:45.293Z",
  "executiveSummary": "zerox 1.1.20 contains a critical OS command injection vulnerability located within its document URL processing logic. The vulnerability arises from the insecure handling of file extensions derived from remote document URLs, which are subsequently passed to system-level shell commands associated with poppler utilities.\nAn unauthenticated attacker can exploit this flaw by supplying a specially crafted URL containing malicious shell metacharacters within the file extension portion. When the application processes the document, it unsafely interpolates this malicious string into a command-line instruction, leading to arbitrary code execution on the underlying operating system.\nThe risk is severe, as it grants attackers the ability to execute unauthorized commands with the privileges of the application process. This may lead to total system compromise, data exfiltration, or unauthorized lateral movement within the hosting infrastructure. Exploitation does not require prior authentication, making it a high-priority concern for any environment utilizing this version of zerox for document ingestion.",
  "technicalDetails": "The vulnerability resides in the document download and preparation mechanism of zerox 1.1.20. When the application retrieves a document via a provided URL, it attempts to identify the file format by parsing the extension from the URI. This extracted extension string is handled in an insecure manner, as it is concatenated directly into a shell command string that invokes poppler-based utilities for document conversion or analysis.\nThe root cause is improper sanitization of user-controlled input (the document extension) before it is passed to a shell execution function (such as child_process.exec in a Node.js environment). Because the input is not validated against a whitelist of expected file types or escaped to prevent shell interpretation, an attacker can break out of the intended command context by injecting command substitution syntax (e.g., $(command), `command`, or `; command`).\nThe attack flow proceeds as follows: 1) An attacker identifies a target endpoint that processes remote document URLs. 2) The attacker crafts a malicious URL where the extension is replaced or appended with shell payload syntax—for example, `http://attacker.com/file.pdf$(whoami > /tmp/pwned)`. 3) Upon submission, the zerox application downloads the file and attempts to rename or process it using the malicious extension. 4) During the execution phase, the underlying shell interprets the injected characters as legitimate commands rather than part of the filename. 5) The command is executed by the OS under the security context of the zerox process.\nThis vulnerability is particularly dangerous because poppler utilities are often invoked as part of a document conversion pipeline, meaning the payload is executed synchronously with the file processing task. There are no authentication requirements for this attack vector, and if the endpoint is reachable over the network, it allows for remote code execution (RCE). The post-exploitation impact includes full system access, potentially allowing the attacker to access sensitive environment variables, read internal files, or establish a persistent backdoor on the server."
}