textract through version 2.5.0 allows an attacker to inject arbitrary operating system commands by supplying a malicious filename that is passed directly to child_process.exec in several extractor modules. This flaw maps to CWE-78 and CWE-94. An attacker who can influence the filename can execute commands on the host system, leading to full compromise of the application server and the underlying operating system.

The affected product is the open‑source npm library textract. Versions 2.5.0 and earlier are vulnerable. Applications built on Node.js that depend on this package and process files with user-supplied names are at risk. No other vendors or products are listed in the CNA data.

The CVSS score of 9.8 marks this as a critical vulnerability. The EPSS score of 4% indicates a moderate likelihood that the flaw may be exploited in the wild. It is not included in CISA’s KEV catalog. The likely attack vector is an attacker providing a specially crafted filename that reaches the child_process.exec call; this requires the application to accept and process untrusted file names. If such a file name is processed, arbitrary commands are executed with the privileges of the Node.js process.