Turnpress (<= 0.4.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/turnpress--0.4.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 16:38:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTurnpress OS Command Injection Vulnerability (CVE-2026-110647)https://feed.craftedsignal.io/briefs/2026-10-turnpress-cve-2026-110647/Wed, 14 Oct 2026 16:38:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-turnpress-cve-2026-110647/Turnpress versions 0.4.2 and earlier are vulnerable to OS command injection via malicious .docx filenames passed to the pandoc conversion process.Turnpress through version 0.4.2 contains a critical OS command injection vulnerability, tracked as CVE-2026-110647. The vulnerability exists within the 'convertDocxToHtml' function located in 'src/converter.ts'. The application invokes the 'pandoc' utility using the 'execa' library with the 'shell:true' option enabled. Because the filename of the provided .docx document is passed directly to the shell as part of the command string without adequate sanitization, an attacker can include shell metacharacters in the filename to execute arbitrary commands. These commands are executed with the privileges of the underlying application, posing a significant risk to the host system. This vulnerability allows for potential remote code execution if an attacker can force the application to process a maliciously named file.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary system commands on the server hosting the Turnpress application. This can lead to full system compromise, data exfiltration, or lateral movement within the environment. The severity is high, with a CVSS v3.1 base score of 7.8, reflecting the ease of exploitation and the potential for complete system takeover.

Recommendation

  • Immediately identify all instances of Turnpress version 0.4.2 or earlier within the environment.
  • Update to a version of Turnpress that addresses CVE-2026-110647 once a patch is released by the maintainers.
  • If updating is not immediately feasible, restrict the application's file upload capabilities and sanitize filenames to prevent the inclusion of shell metacharacters (e.g., ;, |, &, $, `) before they reach the 'convertDocxToHtml' function.
  • Monitor server-side process creation logs for anomalous executions of the 'pandoc' binary or unexpected shells spawned by the Node.js application process.
]]>highadvisory