CVE-2026-110647

Deferred Deferred - Pending Action

OS Command Injection in Turnpress via Malicious .docx Filename

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110647

EUVD

EUVD-2026-101275

Affected Vendors & Products

Vendor	Product	Version / Range
jinghaihan	turnpress	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-110647 is an OS command injection vulnerability in Turnpress versions up to 0.4.2. It allows attackers to execute arbitrary shell commands by providing specially crafted .docx filenames. The vulnerability occurs in the convertDocxToHtml function which uses execa with shell:true to run pandoc. Shell metacharacters in filenames are interpreted as commands, enabling code execution with the user's privileges.

Detection Guidance

Check if Turnpress version 0.4.2 or earlier is installed by running: npm list -g turnpress or npm list turnpress. Inspect the converter.ts file for execa calls with shell:true in the convertDocxToHtml function. Monitor for unexpected shell commands executed during DOCX to HTML conversion processes.

Look for unusual filenames containing shell metacharacters like ;, |, &, or $ in DOCX files processed by Turnpress. Check system logs for commands executed by the user running Turnpress during file conversion tasks.

Impact Analysis

If you use Turnpress to convert untrusted .docx files, an attacker could craft a filename that executes malicious commands on your system. This could lead to data theft, system compromise, or further network infiltration, depending on your user privileges. The attack requires the victim to process a malicious file.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations processing sensitive data with Turnpress may face compliance violations if exploited, potentially resulting in fines or legal consequences.

Mitigation Strategies

Upgrade Turnpress to a version that removes shell:true from execa calls, as shown in the patched pull request. If upgrading is not possible, remove shell:true from execa invocations in converter.ts manually.

Avoid processing untrusted DOCX files with Turnpress until the vulnerability is patched. Implement input validation to reject filenames containing shell metacharacters before conversion.

Hi! I’m here to help you understand CVE-2026-110647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70