Vulnerabilities affecting this package (1)
| Vulnerability |
Summary |
Fixed by |
VCID-kuut-szt9-jufy
Aliases:
CVE-2026-26831
GHSA-9pcj-m5rr-p28g
|
textract is vulnerable to OS Command Injection
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
|
There are no reported fixed by versions.
|
Vulnerabilities fixed by this package (0)
| Vulnerability |
Summary |
Aliases |
|
This package is not known to fix vulnerabilities.
|