CVE-2026-85672: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in getomni-ai zerox

CVE-2026-85672 is an OS command injection vulnerability in getomni-ai zerox affecting versions up to and including 1.1.20. The flaw exists in the file download mechanism where temporary file extensions extracted from document URLs are unsanitized and embedded into shell commands executed by poppler utilities. This improper neutralization of special elements enables attackers to inject command substitution syntax within the file extension, resulting in arbitrary OS command execution prior to document processing.

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands on the affected system with no user interaction required. This can lead to full system compromise, data theft, or service disruption. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with high exploitability and impact on confidentiality, integrity, and availability.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted document URLs or sanitize inputs to prevent command injection. Monitor official getomni-ai communications for updates and apply patches promptly once released.