doc-recog through version 1.1.6 has a critical OS command injection flaw (CVSS 3.1 9.8). Attackers who can control a document path can run arbitrary commands with the privileges of the Node.js process.
What Is It
CVE-2026-110638 is an OS command injection vulnerability (CWE-78) in doc-recog, an npm package maintained by zepspaiva. The flaw is triggered when crafted document paths are passed to the package's recog() or tag() functions.
According to the NVD description, an attacker can put $(...) or backtick command substitution into the file path. DocData._readPDF then passes that path to a shell-based pdftotext exec call. The shell evaluates the injected substitution, and the commands run with the privileges of the Node.js process.
VulnCheck reported the issue. NVD published the record on 2026-10-14, and its status is currently "Received."
Why It Matters
VulnCheck scored the flaw as critical on both scoring systems:
- CVSS 3.1: 9.8 (CRITICAL),
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0: 9.3 (CRITICAL)
The CVSS 3.1 vector describes a network-reachable attack with low complexity. It needs no privileges and no user interaction, and it has high impact on confidentiality, integrity and availability. The supplied data gives only the CVSS 4.0 base score, not its full vector. An application is exposed if it passes externally influenced file paths into recog() or tag(). In that case, an attacker could run arbitrary OS commands on the host as the application's user.
KEV status: The supplied CISA KEV entry is empty. CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog, so there is no KEV confirmation of active exploitation and no CISA-mandated required action or due date. The CVSS 4.0 Exploit Maturity metric is also not defined.
What's Vulnerable
- Vendor: zepspaiva
- Product: doc-recog (
pkg:npm/doc-recog) - Affected versions: all versions from 0 through 1.1.6 (semver)
- Vulnerable code path:
DocData._readPDFindocdata.js, reached throughrecog()ortag()
The NVD record lists no affected CPEs.
Patch Status
The NVD record does not name a fixed version, and every release through 1.1.6 is marked affected. The references include a pull request on the project repository (zepspaiva/doc-recog/pull/2), but the supplied data does not say whether it has been merged or released.
Recommended steps:
- Check whether your projects depend on doc-recog, including as a transitive dependency.
- Watch the repository and the npm package for a release later than 1.1.6.
- Read the VulnCheck advisory for updated guidance.
- Until a fix is confirmed, do not pass untrusted or user-controlled file paths to
recog()ortag().