# CVE-2026-26831: OS command injection in textract

## Summary

`textract` through version `2.5.0` allows OS command injection through
the file path supplied to multiple extractors. Several code paths pass
that file path into `child_process.exec()` with inadequate sanitization.
An attacker who can influence the file name or path can break out of
the command line and run arbitrary commands on the host.

## Affected product

| Product | Affected versions | Fixed version |
| --- | --- | --- |
| textract | all versions through 2.5.0 | no fix available as of 2026-03-24 |

## Vulnerability details

- CVE ID: `CVE-2026-26831`
- CWE: `CWE-78` - OS Command Injection
- CVSS 3.1: `9.8` (`Critical`)
- Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- Affected components:
  - `lib/extractors/doc.js`
  - `lib/extractors/rtf.js`
  - `lib/extractors/dxf.js`
  - `lib/extractors/images.js`
  - `lib/util.js`

One example is the `doc.js` extractor:

```js
exec('antiword -m UTF-8.txt "' + filePath + '"', ...)
```

Another is the `rtf.js` path handling, which only escapes spaces
before executing the shell command. That does not stop metacharacters
such as `;`, backticks, or `$()`.

## Technical impact

Applications often use `textract` on user-uploaded documents. In that
setup, a malicious file name can trigger command execution during text
extraction.

## Proof of concept

An input file name such as:

```text
test";whoami;".doc
```

can break out of the quoted command string when the vulnerable
extractor runs.

## Mitigation

No fixed npm release is available at the time of writing.

If you still depend on this package:

1. Do not pass attacker-controlled file paths to `textract`.
2. Remove shell-string concatenation from extractor code.
3. Replace `exec()` with argument-safe process execution.
4. Move to a maintained text extraction pipeline.

## References

- https://www.npmjs.com/package/textract
- https://github.com/dbashford/textract
- https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js
- https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js
- https://github.com/dbashford/textract/blob/master/lib/util.js