https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 18:34:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277939 EUVD-2026-277939 https://cve.radiocsirt.org/vuln/euvd-2026-277939 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26831 <p>textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization</p> <p>textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26831 https://cve.radiocsirt.org/vuln/ghsa-9pcj-m5rr-p28g <p><strong>Affected:</strong> npm: textract</p> <p>textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization</p> <p><strong>Affected:</strong> npm: textract</p> <p>textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization</p> https://cve.radiocsirt.org/vuln/ghsa-9pcj-m5rr-p28g