Turnpress
Monthly
OS command injection in Turnpress through 0.4.2 allows arbitrary shell commands to be executed with the victim user's privileges when the tool's convert or create operation processes a .docx file whose filename contains shell metacharacters. The flaw sits in convertDocxToHtml (src/converter.ts), which invokes pandoc through execa with shell:true, so the crafted filename is interpreted by the shell rather than treated as a literal argument; exploitation is local (AV:L) and requires the victim to run a convert/create command on the malicious file (UI:R), and no privileges are needed to craft the filename. Impact is high for confidentiality, integrity, and availability on the host running the conversion, but it is limited to the invoking user's privileges with no scope change, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; vendor fix is available via an upstream pull request that removes shell:true.
OS command injection in Turnpress through 0.4.2 allows arbitrary shell commands to be executed with the victim user's privileges when the tool's convert or create operation processes a .docx file whose filename contains shell metacharacters. The flaw sits in convertDocxToHtml (src/converter.ts), which invokes pandoc through execa with shell:true, so the crafted filename is interpreted by the shell rather than treated as a literal argument; exploitation is local (AV:L) and requires the victim to run a convert/create command on the malicious file (UI:R), and no privileges are needed to craft the filename. Impact is high for confidentiality, integrity, and availability on the host running the conversion, but it is limited to the invoking user's privileges with no scope change, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; vendor fix is available via an upstream pull request that removes shell:true.