{"id":"CVE-2026-110635","published":"2026-10-14T15:17:16.560","lastModified":"2026-10-16T19:18:44.867","description":"webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/scionoftech/webp-converter","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/pull/53","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605","tags":[]},{"url":"https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-options","tags":[]}],"exploitRefs":[{"url":"https://github.com/scionoftech/webp-converter","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/pull/53","tags":[]},{"url":"https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to inject OS commands through webp conversion functions that use shell execution, potentially leading to full system compromise when processing malicious files or options.","exploitability":"Exploitation is straightforward for attackers who can control file names or option strings passed to webp conversion functions, requiring no special privileges beyond the ability to trigger the conversion process.","blast_radius":"The impact could be severe across all systems running vulnerable versions of webp-converter, especially those processing user-uploaded files or allowing external input in conversion parameters.","remediation":"Upgrade to version 3.0.0 or later to fix the OS command injection vulnerability in src/webpconverter.js helpers.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","command-injection","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:48:34.745Z"}}