zerox npm Package OS Command Injection Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- zerox (npm)
- Patched version
- Not yet available
An OS command injection vulnerability has been reported in the zerox npm package version 1.1.20. This vulnerability allows attackers to execute arbitrary OS commands before document processing occurs.
What happened
An OS command injection vulnerability has been identified in the zerox npm package version 1.1.20. This vulnerability is present in the file download mechanism of the package. Attackers can exploit this by crafting document URLs with malicious file extensions to execute arbitrary OS commands before document processing occurs. This vulnerability has been assigned the CVE identifier CVE-2026-85672 and has a CVSS score of 9.8 indicating a critical severity level.
The vulnerability was first flagged on 2026-09-04T15:17:45.293000+00:00. It is currently under investigation and has not been reported as exploited in the wild. The affected component is the zerox npm package version 1.1.20.
What to do about it
- Upgrade to a version of zerox that has patched this vulnerability.
- Avoid using the file download mechanism in zerox until a fix is available.
- Monitor the primary sources for updates on the vulnerability and any available patches.
How 0Day would have caught this
zerox is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using the zerox npm package version 1.1.20.
What should I do right now?
Upgrade to a version of zerox that has patched this vulnerability or avoid using the file download mechanism until a fix is available.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.