CVE-2026-110638 zepspaiva CVE debrief

Who should care

Node.js developers and administrators using the doc-recog package, especially those who handle document processing or use the recog() or tag() functions, should assess their exposure and prioritize updating to a secure version of the package.

Why it matters

CVE-2026-110638 is a critical OS command injection vulnerability in the doc-recog package. It allows attackers to execute commands by providing crafted document paths. Node.js developers and administrators should assess exposure, prioritize updates, and review input validation to prevent exploitation.

• Potential for attackers to execute arbitrary commands with Node.js process privileges.
• Possible disruption of document processing services.
• Need for immediate update or patching of the doc-recog package.
• Requirement for review of input validation and sanitization for recog() and tag() functions.

Technical summary

The doc-recog package, used for document recognition in Node.js, is vulnerable to an OS command injection attack. This occurs because the package uses a shell-based pdftotext exec call in the DocData._readPDF function, allowing an attacker to execute commands by providing a crafted file path. The vulnerability is present in versions up to and including 1.1.6. Node.js developers and administrators should assess exposure, prioritize updates, and review input validation to prevent exploitation. Affected product deployments should be identified and owners assigned for follow-up.

Defensive priority

High priority should be given to updating doc-recog to a version beyond 1.1.6, as the package's use of shell-based pdftotext exec calls makes it vulnerable to command injection.

Recommended defensive actions

• Update doc-recog to a version beyond 1.1.6.
• Review and restrict input to recog() and tag() functions to prevent command injection.
• Implement additional monitoring for suspicious activity related to doc-recog usage.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its existence in doc-recog versions up to 1.1.6 and the potential for command injection through crafted document paths.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.