Vendor
Turnpress versions 0.4.2 and earlier are vulnerable to OS command injection via malicious .docx filenames passed to the pandoc conversion process.