CVE-2026-110647
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to…
- Risk score
- 60/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 1.0%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the vi…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
Original description
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
Last activity 14 Oct 2026. Patch Forecast updates every hour.