doc-recog EUVD-2026-101266

Exploitation requires that a consuming application pass an attacker-controlled document file path into doc-recog's recog() or tag() functions, which flow to DocData._readPDF; the attacker embeds shell command substitution ($(...) or backticks) in that path, which is interpreted by the shell-based pdftotext exec call in versions through 1.1.6. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but the practical LIMITING factor is that doc-recog is a library - exploitability hinges on whether the downstream app exposes these path parameters to untrusted or remote input. If paths are hardcoded or validated by the consuming application, the flaw is not reachable. Resolved by upgrading past 1.1.6 (fix uses execFile with an argument array, eliminating shell interpretation).

This is a genuine high-severity flaw but its real-world priority is tempered by the obscurity of the affected component. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and high VC/VI/VA scoring describe unauthenticated, low-complexity remote code execution with full confidentiality, integrity, and availability impact - consistent with CWE-78 OS command injection yielding execution under Node.js process privileges. The vulnerability is strongly confirmed at the code level: the vendor PR #2 diff shows the exact root cause (a shell-based child-process-promise 'exec' concatenating the user-supplied self.filepath into a pdftotext command line) and its fix (switch to 'execFile' with an argument array). However, several exploitation signals are MISSING rather than conflicting: there is no EPSS score, no CISA KEV listing, and no public POC referenced - so exploitation likelihood cannot be quantified. The AV:N rating also warrants scrutiny: doc-recog is a Node.js library, and network reachability is NOT intrinsic to the flaw - it depends entirely on whether a downstream application exposes recog()/tag() file-path input to untrusted/remote callers. Net assessment: technically critical and easily exploitable WHERE reachable, but likely low aggregate real-world risk given the package's minimal deployment footprint and absence of exploitation evidence. Prioritize only if doc-recog is confirmed in your dependency tree with untrusted path input.

An application uses doc-recog and passes a user-influenced document path into recog() or tag(). An attacker submits a path containing shell command substitution such as '/tmp/$(id > /tmp/out).pdf' or backtick syntax, which DocData._readPDF concatenates into a shell-invoked pdftotext command, executing arbitrary commands with the Node.js process's privileges. No public exploit code is referenced, but the vendor PR diff clearly reveals the vulnerable exec call, making weaponization straightforward for an attacker who can reach the function with controlled input.