Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names

Advisories

Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names

Severity: high
Date: 10/14/2026
Affecting: turnpress <= 0.4.2
CVE: CVE-2026-110647
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS: 8.5
CVSS V4 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: https://github.com/jinghaihan/turnpress/pull/2
https://github.com/jinghaihan/turnpress/blob/v0.4.2/src/converter.ts#L33-L61
Credit: Zachariah Mithani
Description: Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo