CVE-2026-110647: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in jinghaihan turnpress

CVE-2026-110647 is an OS command injection vulnerability in jinghaihan's Turnpress product, affecting versions up to 0.4.2. The vulnerability occurs in the convertDocxToHtml function located in src/converter.ts, which calls the pandoc tool via the execa library with shell:true enabled. This allows attackers to supply .docx files with specially crafted filenames containing shell metacharacters, resulting in arbitrary shell command execution under the privileges of the victim during document conversion or creation.

An attacker who can supply a maliciously named .docx file can execute arbitrary shell commands on the affected system with the privileges of the user running Turnpress. This can lead to compromise of the system, data loss, or further attacks. The CVSS 4.0 score is 8.5 (high), indicating significant impact with local attack vector, low attack complexity, no privileges required, but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted .docx files with Turnpress. Consider running Turnpress in a restricted environment or sandbox to limit potential damage from exploitation.