CVE-2026-26831 is a critical (CVSS 9.8) OS command injection in the npm package textract through version 2.5.0. File paths reach child_process.exec() in several extractors. The record names no fixed version, so avoid feeding it untrusted filenames and check the project for a release.
What's affected
The record says textract through 2.5.0 is affected. The calls sit in lib/extractors/doc.js, rtf.js, dxf.js, images.js and in lib/util.js.
No patched version is named in the record. Check the project's repository and the npm page for anything newer than 2.5.0 before you decide the package is safe.
How to check if you're exposed
List where textract sits in your dependency tree:
npm ls textract
npm ls --all | grep textract
Then find the code paths that call it. The risk is real only where a user influenced filename or path reaches textract. Reachability analysis answers that question faster than reading every call site. Safeguard has a free in-browser dependency scan at https://gold.safeguard.sh/scan that checks a dependency file against known CVEs.
What to do now
- Run npm ls textract in each project and record the version.
- Find calls to textract and check whether file names come from uploads, email attachments or other outside input.
- If so, rename files to server generated names before they reach the library, and stop accepting odd characters in names.
- Check the repository and npm page for a release after 2.5.0 that addresses this, and upgrade when one exists.
- If none exists, plan a replacement that does not run through a shell, or isolate the extraction in a sandboxed process.
Why it matters
The record lists CWE-78 (OS command injection) and CWE-94 (code injection). The library builds a command string containing the file path and runs it through a shell. A filename that contains shell syntax can then add its own commands.
Filenames feel harmless because people think of them as labels. In an upload feature they are attacker controlled input, and this CVE is a reminder to treat them that way. The record does not mark the CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the safest immediate step?
Do not let outside input decide the path passed to textract. Generate the name on your side and keep the original name as metadata only.
Sources
- CVE-2026-26831 on Gold
- NVD record for CVE-2026-26831, published 25 March 2026
- Project repository listed in the record: https://github.com/dbashford/textract
- npm package page listed in the record: https://www.npmjs.com/package/textract
Last reviewed: 19 October 2026.
