CVE-2026-110635

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary OS commands with the privileges of the Node.js process. They only need to supply untrusted input to file names or options passed to the converter.

Root cause

The library invokes libwebp binaries using execFile with shell execution enabled, allowing shell metacharacters in arguments to execute arbitrary commands.

Affected systems

webp-converter versions before 3.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade webp-converter to version 3.0.0 or later. If patching immediately is not possible, sanitize all user-supplied filenames and option strings to strictly strip shell metacharacters before passing them to the library.

shell

$ npm install webp-converter@latest

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110635