CVE-2026-110638

Summary

The doc-recog library has an OS command injection vulnerability that allows attackers to execute arbitrary commands on the system by manipulating document paths. This is critical because it can lead to full system compromise when the library processes user-supplied file paths.

Exploitability

Exploitation is straightforward with no special preconditions needed, as attackers can simply embed command substitution syntax in file paths to trigger command execution.

Blast radius

The impact could be severe across all systems using doc-recog 1.1.6 or earlier, potentially allowing attackers to execute arbitrary commands with the privileges of the Node.js process, leading to complete system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.1.7 or later to fix the OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.