CVE-2026-26831 is an OS command injection vulnerability in the textract library up to version 2.5.0. The issue occurs because the filePath parameter, which can be influenced by malicious filenames, is passed unsanitized to child_process.exec() in multiple extractor modules (lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js). This allows remote attackers to execute arbitrary commands on the host system. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The CVSS v3.1 base score is 9.8 (Critical), with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no known exploit in the wild and no vendor patch or advisory currently available.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including arbitrary code execution with the privileges of the application running textract. This impacts confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing files with untrusted or potentially malicious filenames using affected versions of textract. Consider implementing external controls such as sandboxing or restricting execution permissions for processes running textract to limit potential damage.