CVE-2026-85672

zerox 1.1.20, an open-source Node.js document-conversion library that uses poppler utilities for PDF processing, contains an OS command injection flaw (CWE-78) in its file download mechanism. When zerox downloads a document, it derives a temporary file extension from the supplied URL and interpolates it into shell commands without sanitization, so command substitution syntax planted in the URL's file extension executes on the host before document processing begins. An attacker who controls a document URL passed to the application gains arbitrary OS command execution with the privileges of the zerox process, with no authentication or user interaction required. Any application or deployment running zerox 1.1.20 that processes untrusted or user-supplied document URLs is affected. There is no public PoC, the flaw is not in CISA KEV, and the ~1.5% EPSS probability indicates no confirmed exploitation activity yet.

What to do: Upgrade zerox to a release newer than 1.1.20 as soon as a patched version is published (the advisory does not state a fixed version) and rebuild dependent Docker images or application bundles. Until patching, restrict document URLs to a strict allow-list of known document extensions and strip shell metacharacters from URLs, and verify whether your applications pass user-supplied URLs to zerox. Run zerox with least-privileged, network-restricted execution to limit the impact of command injection.