- The Mess: zerox 1.1.20 has an OS command injection hiding inside its document download logic. CVE-2026-85672 lets an attacker abuse a malicious file extension in a document URL to inject commands into shell operations executed by Poppler utilities.
zerox is designed to turn documents into usable text and Markdown. The workflow sounds harmless: fetch a document, save it temporarily, run the conversion pipeline, return the result.
The problem is what happens between downloading the document and processing it.
zerox derives the temporary file extension from the supplied document URL. That value eventually reaches shell commands used to invoke Poppler.
The extension should have been treated as untrusted data.
Instead, an attacker can manipulate it so that shell metacharacters and command-substitution syntax become part of the command executed by the host.
That turns a document-processing feature into a command-execution primitive.
No complicated memory corruption is required.
No kernel exploit.
No browser sandbox escape.
Just a malicious URL and a parser that trusted too much of it.
- The Damage: A successful attack can execute arbitrary operating-system commands with the privileges of the zerox process, potentially exposing application secrets, modifying files or taking control of the host.
This is particularly nasty for applications that accept document URLs from users or process remotely supplied documents automatically.
A public-facing service could effectively become an attacker-controlled command runner.
The vulnerable path is the file-download mechanism. zerox creates a temporary filename based on information extracted from the remote document URL, then uses that filename while invoking Poppler.
That creates the injection boundary.
An attacker does not necessarily need to upload a conventional executable payload. The dangerous input is embedded in the filename/extension itself.
And that matters because document-processing systems are frequently treated as data-only infrastructure.
They are not.
The moment a server downloads attacker-controlled content and passes derived filenames into shell commands, the document has crossed from “data” into “input capable of influencing execution.”
CVE-2026-85672 was published on September 4, 2026 and affects zerox 1.1.20. The vulnerability is classified as OS command injection, making it a significantly more serious problem than a simple malformed-document crash.
The project also has a public GitHub issue associated with the vulnerability, alongside the affected source code and repository references.
- The Fix: Upgrade zerox to a version containing the security fix and, until patched, prevent untrusted users from supplying arbitrary document URLs to the affected processing path.
Administrators should also inspect applications built around zerox rather than checking only the standalone package.
If zerox is embedded inside an API, AI document pipeline, OCR service or internal automation platform, the vulnerable code may be several layers below the application developers’ own code.
Check the installed version.
Look for:
zerox 1.1.20
Then determine whether external users can influence document URLs processed by the application.
If they can, treat the service as potentially exposed.
After patching, review process execution logs and application telemetry for unusual Poppler invocations, suspicious document URLs and unexpected child processes launched by the document-processing service.
Also remember the privilege model.
If the zerox process runs as root, the blast radius is dramatically worse than if it runs inside a restricted container under an unprivileged account.
Document converters should never need unnecessary privileges.
This vulnerability is currently not accompanied by confirmed evidence of widespread active exploitation. But command injection in a server-side document-processing pipeline is exactly the sort of primitive that tends to become interesting once attackers understand where it is deployed.
Bugstoday’s Opinion
This is why “it’s just a document parser” is a terrible security argument.
The application sees a PDF.
The operating system sees a string that eventually reaches a shell.
Attackers don’t care what the developer intended the input to represent. They care about what the final parser, command interpreter or process launcher actually does with it.
zerox trusted a filename extension.
The shell trusted the attacker.
That’s enough.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
CVE-2026-85672
NVD
MITRE CVE
zerox / GitHub
zerox GitHub Issue #206
VulnCheck Advisory
