Skip to main content
cve.nowby Sazabi
← npm
npmPackage

textract

1 known vulnerability (1 critical), with the versions each affects and the releases that fix them.

Latest release
2.5.0 (Jun 3, 2019): affected by CVE-2026-26831
Newest unaffected release
Every release is affected by at least one advisory
Advisories
1 · 1 critical
Weekly downloads
16.6K
Dependents
70
Releases
46 since 0.0.1 (Apr 26, 2013)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 1

  • CVE-2026-26831Critical 9.8

    textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors.

    Affected: through 2.5.0.

    No fix released. The latest release, 2.5.0, is still affected.

    100% of textract downloads last week were affected versions (24.3K).