CVE-2026-85672
Medium
Elevated severity or exploit probability.
CVSS base
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
2.6%
84.5th percentile
CISA KEV
Not listed
Weakness / dates
CWE-78
Published 2026-09-04 · modified 2026-09-23
Description
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions containing command substitution syntax to execute arbitrary OS commands before document processing occurs.
References
- https://github.com/getomni-ai/zerox
- https://github.com/getomni-ai/zerox/blob/main/node-zerox/src/utils/file.ts
- https://github.com/getomni-ai/zerox/issues/206
- https://www.vulncheck.com/advisories/zerox-1.1.20-os-command-injection-via-document-url-file-extension
- https://github.com/getomni-ai/zerox/issues/206