CVE-2026-110647
Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
| CWE | CWE-78 |
| Vendor | jinghaihan |
| Product | turnpress |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for jinghaihan turnpress
Be the first to know when new high vulnerabilities affecting jinghaihan turnpress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
jinghaihan / turnpress
0 ≤ 0.4.2
References
Credits
Zachariah Mithani