Vulnerabilities

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with…

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.

Read at NIST National Vulnerability Database (CVE API 2.0)

CVSS

7.8

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-110647 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 23
   CVE NVD 17d ago

   transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted…

   CVSS 9.8 CVE-2026-110643 Node.js
2. 23
   CVE NVD 17d ago

   office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted…

   CVSS 9.8 CVE-2020-37282 Microsoft