CVE-2026-85672: zerox 1.1.20 RCE Vulnerability

CVE-2026-85672 Overview

CVE-2026-85672 is an OS command injection vulnerability [CWE-78] affecting zerox version 1.1.20, an open-source document processing library maintained by getomni-ai. The flaw resides in the file download mechanism, where the temporary file extension derived from a document URL is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can supply a document URL with a crafted file extension containing shell command substitution syntax to execute arbitrary operating system commands. Exploitation occurs before document processing begins, making the vulnerability reachable through any zerox integration that accepts remote document URLs from untrusted input.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary OS command execution on any host running zerox 1.1.20 by submitting a document URL with a malicious file extension.

Affected Products

• zerox 1.1.20 (getomni-ai)
• Node.js applications embedding the node-zerox package
• Downstream services exposing zerox document ingestion to user-supplied URLs

Discovery Timeline

• 2026-09-04 - CVE-2026-85672 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85672

Vulnerability Analysis

zerox converts documents into structured data by delegating rendering tasks to poppler command-line utilities such as pdftoppm and pdftocairo. When zerox downloads a remote document, it derives a temporary local filename by extracting the file extension from the source URL. That extension is then concatenated into shell command strings without sanitization or argument escaping. The vulnerable logic resides in node-zerox/src/utils/file.ts and is triggered before the downloaded content is inspected, so no valid document is required for exploitation. Because zerox is commonly deployed as a backend service that accepts URLs from web forms, APIs, or LLM pipelines, the vulnerable code path is often exposed to untrusted network input.

Root Cause

The root cause is untrusted input flowing directly into a shell command interpreter. The extension parser trusts the URL-derived string and passes it into a template evaluated by /bin/sh, satisfying the classic [CWE-78] pattern of improper neutralization of special elements used in an OS command.

Attack Vector

An attacker submits a document URL whose path ends with a crafted extension containing backticks or $(...) command substitution. When zerox writes the downloaded file to a temporary path and invokes a poppler utility on it, the shell evaluates the substitution and executes the attacker's payload with the privileges of the zerox process. The attack requires no authentication, no user interaction, and can be delivered over the network. See the VulnCheck Advisory for Zerox 1.1.20 and GitHub Issue #206 for Zerox for reproduction details.

Detection Methods for CVE-2026-85672

Indicators of Compromise

• Inbound HTTP requests to zerox endpoints containing URL paths with shell metacharacters such as backticks, $(, ;, |, or & inside the file extension component.
• Child processes of the Node.js runtime spawning /bin/sh, pdftoppm, or pdftocairo with unusual arguments containing command substitution syntax.
• Outbound network connections from the zerox host to attacker-controlled infrastructure shortly after a document ingestion request.

Detection Strategies

• Log and inspect all document URLs submitted to zerox, alerting on extensions that contain non-alphanumeric characters.
• Monitor process ancestry for node processes that spawn shells or poppler binaries with arguments referencing $() or backticks.
• Correlate document ingestion events with newly created files in temporary directories that carry suspicious extensions.

Monitoring Recommendations

• Enable command-line auditing (auditdexecve rules on Linux) for the account running zerox and forward events to a central analytics platform.
• Track outbound DNS and TCP connections initiated by the zerox process to identify post-exploitation callbacks.
• Baseline expected poppler command invocations and alert on deviations in argument structure.

How to Mitigate CVE-2026-85672

Immediate Actions Required

• Restrict zerox to trusted document sources by validating URLs against an allowlist before invoking the download function.
• Reject any URL whose extension contains characters outside [A-Za-z0-9] prior to passing it to zerox.
• Run the zerox service under a dedicated low-privilege account with no shell access and no outbound network egress beyond required destinations.

Patch Information

No fixed version is referenced in the NVD entry at the time of publication. Consult the GitHub Repository for Zerox and the tracking GitHub Issue #206 for Zerox for the current status of an upstream fix. Review the vulnerable logic in node-zerox/src/utils/file.ts when evaluating custom patches.

Workarounds

• Fork zerox and replace shell-based invocations of poppler with child_process.execFile or spawn using an argument array to eliminate shell interpretation.
• Sanitize the temporary filename by generating it from a cryptographic hash of the URL rather than deriving it from the URL path.
• Place a reverse proxy or WAF in front of zerox endpoints to strip or reject document URLs containing shell metacharacters.
• Execute zerox inside a container or sandbox with a read-only filesystem and no interactive shell available on PATH.

# Example allowlist validation before invoking zerox
url="$1"
ext="${url##*.}"
if [[ ! "$ext" =~ ^[A-Za-z0-9]{1,8}$ ]]; then
  echo "Rejected: invalid extension" >&2
  exit 1
fi