{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/doc-recog--1.1.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:*:doc-recog:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110638"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["doc-recog (\u003c= 1.1.6)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe doc-recog library (versions 1.1.6 and earlier) contains an OS command injection vulnerability, identified as CVE-2026-110638. The vulnerability originates in the DocData._readPDF method, which fails to sanitize user-provided document paths before passing them to a shell-based invocation of the pdftotext utility. By supplying a specially crafted document path containing shell metacharacters, such as command substitution sequences ($(cmd)) or backticks, an attacker can cause the underlying Node.js application to execute arbitrary commands with the privileges of the Node.js process. This vulnerability is highly critical due to the ease of exploitation and the potential for full system access depending on the context in which the Node.js application is running.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe application exposes an endpoint or interface that accepts document paths from a user.\u003c/li\u003e\n\u003cli\u003eThe attacker provides a crafted document path input string containing malicious shell metacharacters like $(whoami) or \u003ccode\u003eid\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application passes the malicious string to the recog() or tag() functions within the doc-recog library.\u003c/li\u003e\n\u003cli\u003eThe library internally invokes the DocData._readPDF method.\u003c/li\u003e\n\u003cli\u003eThe DocData._readPDF method fails to sanitize the input path and includes it directly in a shell command string formatted for the pdftotext binary.\u003c/li\u003e\n\u003cli\u003eThe shell executes the command string, causing the injected malicious commands to trigger immediately.\u003c/li\u003e\n\u003cli\u003eThe application returns the output of the injected command or proceeds to crash, while the attacker achieves unauthorized command execution on the host system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary system commands on the server hosting the doc-recog library. This can lead to full system compromise, data exfiltration, or lateral movement within the environment. Given the widespread use of Node.js libraries in web applications, the scope of impact includes any service utilizing doc-recog for document processing.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the doc-recog library to a patched version beyond 1.1.6 as soon as it becomes available.\u003c/li\u003e\n\u003cli\u003eAudit all applications utilizing doc-recog to identify code paths where user input influences the document path parameter.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on all file paths to ensure they conform to expected formats and contain only alphanumeric characters, preventing shell metacharacter injection.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement a WAF rule to block requests containing shell substitution characters in paths directed toward the application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:33:21Z","date_published":"2026-10-14T16:33:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-doc-recog-rce/","summary":"The doc-recog library through version 1.1.6 is vulnerable to OS command injection via crafted document paths passed to the recog() or tag() functions.","title":"OS Command Injection in doc-recog Library","url":"https://feed.craftedsignal.io/briefs/2026-10-doc-recog-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Doc-Recog (\u003c= 1.1.6)","version":"https://jsonfeed.org/version/1.1"}