jinghaihan CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH jinghaihan CVE published 2026-10-14

CVE-2026-110647

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The vulnerability is in the convertDocxToHtml function in src/converter.ts, which invokes pandoc through execa with shell:true, allowing shell metacharacters in the --docx path to run with the victim's privileges during convert or create. Defen [truncated]