The vulnerability occurs in the textract library version 2.5.0 and earlier because the filePath parameter supplied to various extractors is passed directly to child_process.exec without sanitization. This allows an attacker to inject arbitrary operating system commands, potentially leading to remote code execution. The weakness maps to CWE-78: OS Command Injection and CWE-94: Improper Syntax Handling. The attacker could take control of the system running the library if a malicious filename is processed.

The vulnerability affects the open‑source npm package textract, versions up to and including 2.5.0. Applications built with Node.js that depend on this package are at risk. No other vendors or products are listed. The supporting CPE indicates a Node.js environment. Any project using textract < 2.5.0 for document, RTF, DXF, or image extraction is impacted.

The CVSS score of 9.8 indicates critical severity. The EPSS score is below 1%, suggesting that exploitation is currently uncommon. The issue is not present in CISA’s Known Exploited Vulnerabilities catalog. Because the attacker must supply a crafted file name that reaches the child_process.exec call, the attack vector is execution of arbitrary commands on the host where the application runs. If an application exposes textract to untrusted input, an attacker could trigger compromised system behavior.