zerox OS Command Injection via Malicious Document URL File Extension

Technical Analysis

The vulnerability stems from zerox's temporary file extension derivation logic, which extracts the extension from a user- or agent-supplied document URL and interpolates it unsanitized into shell commands invoked when calling poppler utilities (e.g., pdftoppm/pdftocairo) for document conversion. Because the extension is not validated or escaped, an attacker can embed shell metacharacters or command substitution syntax (e.g., backticks or $()) within the crafted URL, causing the underlying shell to execute arbitrary OS commands at the point of temporary file creation, prior to actual document parsing. This is a classic unsanitized-input-to-shell-exec pattern (CWE-78), exploitable remotely with no authentication and low complexity, consistent with the CVSS 9.8 rating. Exploitation requires only that the target application accept a document URL and pass it to zerox for processing, making this attractive for automated scanning and worm-like exploitation against exposed document ingestion endpoints. Because zerox is frequently used as a document-parsing/OCR component within RAG pipelines and AI agent document-ingestion workflows, any agent system that autonomously fetches and processes untrusted document URLs (e.g., from web search results, email attachments, or user-supplied links) could trigger this RCE, potentially leading to full compromise of the agent host, exfiltration of API keys/credentials used by the agent, or pivoting into connected internal systems.

Affected Systems

zerox version 1.1.20 (and potentially earlier versions using the same file download/extension-handling logic) deployed on systems with poppler-utils installed; any RAG pipeline, document-ingestion service, or AI agent tool that invokes zerox to convert or OCR documents retrieved from user- or externally-supplied URLs

Indicators of Compromise

• N/A - No specific hashes, IPs, or domains published at this time
• Suspicious document URLs containing shell metacharacters in file extension segment (e.g., trailing backticks, $(), ;, |, &&)
• Unexpected child processes spawned from poppler utilities (pdftoppm, pdftocairo, pdfinfo)
• Anomalous outbound connections or command execution originating from document-processing/ingestion services

Remediation Steps

1. 1

   Upgrade zerox

   Update to a patched version of zerox once released by the maintainers; monitor the project's GitHub/security advisories for a fix.

2. 2

   Sanitize and validate URLs

   Implement strict validation and allowlisting of document URLs and file extensions before passing them to zerox or any downstream shell-invoking utility; reject URLs containing shell metacharacters.

3. 3

   Sandbox document processing

   Run document conversion and OCR operations (zerox/poppler) inside isolated, least-privilege containers or sandboxes with no network egress and restricted filesystem access to limit blast radius of RCE.

4. 4

   Avoid shell interpolation

   If self-patching or forking zerox, replace shell command construction with parameterized subprocess calls (e.g., execve-style argument arrays) that never pass user input through a shell.

5. 5

   Audit AI agent/RAG pipelines

   Review all AI agent and RAG ingestion pipelines for use of zerox or similar document-processing libraries; ensure agents do not autonomously fetch and process arbitrary untrusted document URLs without validation.

6. 6

   Rotate exposed credentials

   If exploitation is suspected, rotate API keys, tokens, and credentials accessible to the compromised host, particularly those used by connected AI agent services.