zepspaiva CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL zepspaiva CVE published 2026-10-14

CVE-2026-110638

A critical vulnerability exists in doc-recog, a Node.js package for document recognition, versions up to and including 1.1.6. The vulnerability is an OS command injection issue via the DocData._readPDF file path. Attackers can exploit this by providing crafted document paths to the recog() or tag() functions, embedding $(...) or backtick command substitution in the file path. This allows the execution of [truncated]