CVE-2026-110638: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in zepspaiva doc-recog

CVE-2026-110638 is an OS command injection vulnerability in the zepspaiva doc-recog library through version 1.1.6. The vulnerability occurs when an attacker supplies a malicious document path containing shell command substitution syntax ($(...) or backticks) to the recog() or tag() functions. The vulnerable code passes this path to a shell execution of pdftotext within the DocData._readPDF method, allowing arbitrary command execution with the privileges of the Node.js process running doc-recog.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the host running doc-recog, potentially leading to full system compromise depending on the Node.js process privileges. The vulnerability is critical due to its ability to execute commands without any required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted document paths with doc-recog or implement strict input validation and sanitization to prevent command injection. Monitor official vendor channels for updates and patches.