TI-2026-74132 CVE-2026-110638 · GHSA-xjwr-pqr4-r7h8doc-recog OS Command Injection via DocData._readPDF File PathPriority MEDIUM 53doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.02727 · Published 2026-10-14 · No fix listed CWE-78
