CVE record · 1 source
CVE-2026-110638
CVSS 9.8doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths…
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 9.8
- EPSS
- 0.027 (p86)
- Exposure class
- Developer platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths…
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution…