External risk intelligence

Doc-Recog OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110638

The vulnerability exists in a Node.js library for document recognition and PDF processing. While these functions are often integrated into public-facing web applications that handle user-uploaded documents, the library itself is a component rather than a standalone edge service or gateway. Consequently, public exposure depends entirely on the specific implementation by the developer, making internet reachability possible but not inherent.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue has been identified in a document recognition library that could allow attackers to execute commands on the system by manipulating document file paths. This vulnerability affects how certain documents are processed, potentially leading to unauthorized command execution with the privileges of the Node.js process. The main concern is to confirm if this specific library is in use and exposed to risk.

Allows commands through crafted document paths.
Leadership should remember this for potential exposure.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted document path to an application that uses the doc-recog library. This path can contain commands that are executed by the underlying system. This could lead to the execution of arbitrary commands with the privileges of the Node.js process.

Network access to the vulnerable application is required.
Crafted document paths submitted to `recog()` or `tag()` functions.
Arbitrary command execution with Node.js process privileges.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary operating system commands on systems running doc-recog through 1.1.6 when processing specially crafted document paths. This could occur when the `recog()` or `tag()` functions receive a document path that contains shell command substitution. The Node.js process running doc-recog would execute these commands with its own privileges.

Node.js process command execution.
Crafted document paths are supplied.
Arbitrary OS commands could run.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS command injection vulnerability in `doc-recog` impacts applications processing documents, particularly via the `readPDF` function. Ownership likely resides with the application development team or platform team responsible for the Node.js environment, with initial steps involving inventorying affected systems, assessing business criticality and external reachability, identifying the accountable owner, and then planning remediation based on risk.

Application or platform teams should own.
Verify external reachability and critical systems.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the doc-recog library used for?

doc-recog is a Node.js software library designed to assist with document recognition and PDF processing tasks. Developers integrate it into applications to automate the extraction or identification of document content. Because it handles file-based operations, it is commonly found in backend services that manage user-submitted files or automated data ingestion pipelines.

What does OS command injection mean in CVE-2026-110638?

This vulnerability is classified as CWE-78: OS Command Injection. It occurs when an application inadvertently passes untrusted user input directly to the operating system's command shell. In this case, the library processes a document path as if it were a simple file name, but because it does not sanitize the input, an attacker can insert shell commands. The system then executes these malicious instructions with the same permissions as the Node.js process.

How can an attacker trigger this vulnerability?

An attacker triggers the flaw by submitting a specially crafted document path to the library's recog() or tag() functions. By including shell command substitution characters—like backticks or the $(...) syntax—within the path, the attacker forces the system to run unintended commands. Simply providing a standard, legitimate file path to the library does not trigger the vulnerability, as the security issue specifically relies on these malicious, active characters being present.

Why does Halo Surface Signal categorize this as external?

Halo Surface Signal notes that while doc-recog is a backend library rather than an edge gateway, it is often utilized in public-facing web applications that accept user-uploaded documents. Because the library's functions can be reached via network inputs in these implementations, the potential for internet-based exploitation exists. Assessment depends on whether your specific web application exposes these document processing features to the open internet.

What are the first steps to address this CVE?

Begin by inventorying your environment to confirm where doc-recog is installed and identifying the specific application teams responsible for those Node.js environments. Once located, assess whether the application processes user-supplied file paths in an internet-facing context. Prioritize these high-reachability systems for review, as they present the greatest risk while you plan your remediation strategy.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.