Doc Recog
Monthly
OS command injection in doc-recog through 1.1.6 allows remote attackers to execute arbitrary commands with Node.js process privileges by supplying crafted document paths containing $(...) or backtick command substitution to the recog() or tag() functions, which flow to a shell-based pdftotext exec call in DocData._readPDF. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but real-world exploitability hinges on whether a consuming application passes attacker-controlled paths into the library; if paths are hardcoded or validated downstream, the flaw is not reachable. No public exploit code has been identified at time of analysis, and the upstream fix (PR #2) switches to execFile with an argument array to eliminate shell interpretation.
OS command injection in doc-recog through 1.1.6 allows remote attackers to execute arbitrary commands with Node.js process privileges by supplying crafted document paths containing $(...) or backtick command substitution to the recog() or tag() functions, which flow to a shell-based pdftotext exec call in DocData._readPDF. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but real-world exploitability hinges on whether a consuming application passes attacker-controlled paths into the library; if paths are hardcoded or validated downstream, the flaw is not reachable. No public exploit code has been identified at time of analysis, and the upstream fix (PR #2) switches to execFile with an argument array to eliminate shell interpretation.