CVEvulnerability
CVE-2026-110635
9.3 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-10-14
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-78
Description
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/scionoftech/webp-converter github.com
- https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52 github.com
- https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md github.com
- https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a github.com
- https://github.com/scionoftech/webp-converter/pull/53 github.com
- https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605 github.com
- https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-options www.vulncheck.com