{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/turnpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:turnpress:turnpress:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-110647"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Turnpress (\u003c= 0.4.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Turnpress"],"content_html":"\u003cp\u003eTurnpress through version 0.4.2 contains a critical OS command injection vulnerability, tracked as CVE-2026-110647. The vulnerability exists within the 'convertDocxToHtml' function located in 'src/converter.ts'. The application invokes the 'pandoc' utility using the 'execa' library with the 'shell:true' option enabled. Because the filename of the provided .docx document is passed directly to the shell as part of the command string without adequate sanitization, an attacker can include shell metacharacters in the filename to execute arbitrary commands. These commands are executed with the privileges of the underlying application, posing a significant risk to the host system. This vulnerability allows for potential remote code execution if an attacker can force the application to process a maliciously named file.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary system commands on the server hosting the Turnpress application. This can lead to full system compromise, data exfiltration, or lateral movement within the environment. The severity is high, with a CVSS v3.1 base score of 7.8, reflecting the ease of exploitation and the potential for complete system takeover.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately identify all instances of Turnpress version 0.4.2 or earlier within the environment.\u003c/li\u003e\n\u003cli\u003eUpdate to a version of Turnpress that addresses CVE-2026-110647 once a patch is released by the maintainers.\u003c/li\u003e\n\u003cli\u003eIf updating is not immediately feasible, restrict the application's file upload capabilities and sanitize filenames to prevent the inclusion of shell metacharacters (e.g., ;, |, \u0026amp;, $, `) before they reach the 'convertDocxToHtml' function.\u003c/li\u003e\n\u003cli\u003eMonitor server-side process creation logs for anomalous executions of the 'pandoc' binary or unexpected shells spawned by the Node.js application process.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:38:07Z","date_published":"2026-10-14T16:38:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-turnpress-cve-2026-110647/","summary":"Turnpress versions 0.4.2 and earlier are vulnerable to OS command injection via malicious .docx filenames passed to the pandoc conversion process.","title":"Turnpress OS Command Injection Vulnerability (CVE-2026-110647)","url":"https://feed.craftedsignal.io/briefs/2026-10-turnpress-cve-2026-110647/"}],"language":"en","title":"CraftedSignal Threat Feed - Turnpress","version":"https://jsonfeed.org/version/1.1"}