GCVE - cpe:2.3:a:dbashford:textract:*:*:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dbashford:textract:*:*:*:*:*:node.js:*:*

part: a version: * update: *

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:github/dbashford/textract`	purl2cpe	2026-06-01 10:12:29.360209
`pkg:npm/textract`	purl2cpe	2026-06-01 10:12:29.360211

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-26831`	vulnerable	2026-06-08 07:53:21.732425	Details available textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization Published: 2026-03-25T00:00:00.000Z Updated: 2026-03-28T01:12:59.787Z Open on db.gcve.eu Reference links https://www.npmjs.com/package/textract https://github.com/dbashford/textract https://github.com/dbashford/textract/blob/master/lib/extractors/doc.js https://github.com/dbashford/textract/blob/master/lib/extractors/rtf.js https://github.com/dbashford/textract/blob/master/lib/util.js	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.