CVE-2026-110647 jinghaihan CVE debrief

Who should care

Defenders and administrators of Turnpress installations, especially those processing untrusted .docx files, should assess exposure and prioritize remediation to prevent potential exploitation and unauthorized access. This includes reviewing and restricting usage of the convertDocxToHtml function, implementing additional security controls, and verifying affected versions and remediation status.

Why it matters

Defenders should prioritize verifying and remediating this high-severity OS command injection vulnerability in Turnpress installations, especially those processing untrusted .docx files, to prevent potential exploitation and unauthorized access.

• Potential execution of arbitrary shell commands
• Possible elevation of privileges
• Required verification of affected versions and remediation status

Technical summary

The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, allowing shell metacharacters in the --docx path to run with the victim's privileges during convert or create. This vulnerability allows attackers to execute shell commands by supplying .docx files with crafted names, potentially leading to unauthorized access and elevation of privileges. Defenders should prioritize verifying and remediating this high-severity OS command injection vulnerability in Turnpress installations, especially those processing untrusted .docx files.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Turnpress installations, especially those processing untrusted .docx files.

Recommended defensive actions

• Verify and remediate Turnpress installations, especially those processing untrusted .docx files
• Review and restrict usage of the convertDocxToHtml function
• Implement additional security controls to prevent exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is in the convertDocxToHtml function in src/converter.ts, which invokes pandoc through execa with shell:true, allowing shell metacharacters in the --docx path to run with the victim's privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.