Turnpress: OS command injection via crafted .docx file names

Summary

Turnpress up to and including 0.4.2 contains an OS command injection flaw (CWE-78). The convertDocxToHtml function calls pandoc through execa with shell enabled, so shell metacharacters in a .docx file name run with the privileges of the user who runs convert or create. Exploitation requires a crafted file name that the tool processes, so the risk mainly applies to automated or batch workflows that handle files from untrusted sources. No fixed version has been published yet.

Affected

• Turnpress (npm package turnpress) versions 0 to and including 0.4.2
• Default configuration as documented by the vendor and the CVE record

Fixed in

Unknown. No vendor release or advisory names a fixed version. An open pull request (#2) proposes removing shell: true from the execa calls.

Workaround

• Do not run convert or create on .docx files whose names come from untrusted sources, such as uploads, email attachments or shared drives.
• Run Turnpress in an isolated container or throwaway VM without access to secrets, and do not run it with administrator rights.
• Check whether any project or CI pipeline uses turnpress 0.4.2 or earlier (for example with npm ls turnpress).
• Optionally apply the change proposed in pull request #2 in a private fork, if the team can maintain it and test it.

Exploitation

• Exploited in the wild: nothing known.
• Public exploit or proof of concept: VulDB reports that no exploit is available.
• The pull request author reports having reproduced command execution on 0.4.2 through the CLI. This has not been independently verified.
• CISA KEV: not listed.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.

Our recommendation

• Identify whether Turnpress is installed in your environment, especially in CI jobs, build servers or documentation workflows.
• Do not process .docx files from untrusted sources with Turnpress until a fixed version is available.
• Run any affected instance in a restricted, non-administrative environment.
• Monitor the upstream repository and the npm package for a fixed release and update promptly once one is published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Turnpress converter.ts at v0.4.2 github.com
• Turnpress pull request #2 (command injection fix) github.com
• VulnCheck advisory: Turnpress through 0.4.2 OS command injection www.vulncheck.com
• VulDB entry 420030 vuldb.com
• Turnpress GitHub repository github.com
• Strix CVE-2026-110647 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:34.