CVE-2016-10320

textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function

published April 6, 2017

CVSS
—
EPSS
2%
Percentile
80.6
In the wild
Unconfirmed
What it is

textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02009 · 80.6th percentile
Published
2017-04-06T18:00Z
EPSS history
Timeline
  • 06 APR 18:00Z
    textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function
    cvelistv5