Exploitation Summary
EIP tracks 1 public exploit for CVE-2026-26831. PoCs published by zebbernCVE.
AI-analyzed exploit summary The repository provides a detailed technical analysis of CVE-2026-26831, an OS command injection vulnerability in the `textract` npm package. It includes affected components, code snippets, and a proof-of-concept example demonstrating how malicious file names can exploit inadequate sanitization in `child_process.exec()` calls.
Description
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
Exploits (1)
The repository provides a detailed technical analysis of CVE-2026-26831, an OS command injection vulnerability in the `textract` npm package. It includes affected components, code snippets, and a proof-of-concept example demonstrating how malicious file names can exploit inadequate sanitization in `child_process.exec()` calls.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H