Is CVE-2026-110647 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110647?

CVE-2026-110647 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-110647

Description

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.