Turnpress through version 0.4.2 contains a command injection flaw that allows an attacker to execute arbitrary shell commands on the host system by supplying a .docx file with a specially crafted filename. The vulnerability arises from the convertDocxToHtml function invoking pandoc via execa with the shell option enabled, which causes shell metacharacters in the file path to be interpreted by the victim’s account during conversion. This weakness is classified as CWE-78 and can lead to full remote code execution in the context of the running application.

The affected product is Turnpress, a document conversion utility maintained by vendor jinghaihan. The vulnerability exists in all releases up to and including version 0.4.2; no later versions are mentioned in the advisory.

The CVSS v3.1 score for this vulnerability is 8.5, indicating high severity. The EPSS score is approximately 1.04%, indicating a low but non-zero probability of exploitation, while the high Base score suggests exploitation is feasible in a realistic environment. The vulnerability is not listed in CISA’s KEV catalog, meaning it is not known to be actively exploited at the time of this analysis. Based on the description, the likely attack vector is an attacker controlling the file name of a .docx file that is processed by the Turnpress conversion routine, and it is inferred that a web‑application context where users can upload documents would allow such control. Because the crafted filename is processed by a shell, a local attacker or anyone who can influence the conversion input has the potential to execute arbitrary commands with the privileges of the application process.