Zerox
Monthly
OS command injection in getomni-ai's zerox 1.1.20 (the node-zerox document-to-markdown library) lets remote attackers execute arbitrary shell commands by supplying a document URL whose file extension contains command-substitution syntax. The unsanitized extension is interpolated into shell commands run by poppler utilities during file download, so injection fires before any document processing. Reported by VulnCheck; no public exploit code is identified at time of analysis and it is not in CISA KEV, though the fix issue is public.
OS command injection in getomni-ai's zerox 1.1.20 (the node-zerox document-to-markdown library) lets remote attackers execute arbitrary shell commands by supplying a document URL whose file extension contains command-substitution syntax. The unsanitized extension is interpolated into shell commands run by poppler utilities during file download, so injection fires before any document processing. Reported by VulnCheck; no public exploit code is identified at time of analysis and it is not in CISA KEV, though the fix issue is public.