doc-recog: OS command injection via document path in DocData._readPDF
Summary
doc-recog through version 1.1.6, a Node.js npm library for document recognition, passes file paths to a shell-based pdftotext call. An attacker who can influence the file path given to recog() or tag() can embed command substitution such as $(...) or backticks and run arbitrary commands with the privileges of the Node.js process. Exploitation requires that untrusted input reaches the vulnerable function, typically through an upload or document-intake feature.
Affected
- doc-recog versions 0 to 1.1.6 (per CVE record and advisory sources)
- Exposure depends on whether an application passes user-controlled paths to recog() or tag()
Fixed in
Unknown. No vendor advisory or fixed release was found. The linked pull request #2 could not be verified as merged or containing a fix.
Workaround
- Do not pass untrusted file names or paths to doc-recog; accept only uploads with server-generated file names
- Validate and canonicalise paths against an allow-list of directories before calling the library
- Fork the library and replace the shell call with a non-shell process invocation using an argument array, after verifying on the pinned code
- Run the Node.js process with least privilege in a container or sandbox with no unnecessary write or outbound network access
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No evidence of exploitation in the wild found in the sources checked; CISA KEV status not checked
- No public proof of concept found
- EPSS score reported as 0.02727 by one aggregator
Our recommendation
- Inventory Node.js projects for the doc-recog dependency, including transitive dependencies
- Check whether any service lets external users influence the file path passed to recog() or tag(); treat internet-facing upload workflows as high priority
- Apply the workarounds above until an upstream fix is confirmed, and plan to replace the library if no fixed release appears
- Monitor the vendor repository and advisories for a fix
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Vulnerable code (docdata.js) github.com
- doc-recog repository github.com
- doc-recog pull request #2 github.com
- Threatint CVE record cve.threatint.com
- Strix CVE summary www.strix.ai
- Mend/Vulners entry vulners.com
- OffSeq radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:07.
Original description (NVD)
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.