Product
The doc-recog library through version 1.1.6 is vulnerable to OS command injection via crafted document paths passed to the recog() or tag() functions.