Vulnerabilities affecting this package (1)
| Vulnerability |
Summary |
Fixed by |
VCID-ndz5-ppun-h3ft
Aliases:
CVE-2026-26831
GHSA-9pcj-m5rr-p28g
|
textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization
|
There are no reported fixed by versions.
|
Vulnerabilities fixed by this package (0)
| Vulnerability |
Summary |
Aliases |
|
This package is not known to fix vulnerabilities.
|