CVE-2026-110648

7.8High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Attackers can execute arbitrary shell commands with the privileges of the Node.js process. They need a user or service to process a font file with a malicious name.

Root cause

Font file paths are interpolated unquoted into a FontForge command executed via child_process.execSync.

Affected systems

@offactory/compress-fonts before 1.1.1

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade @offactory/compress-fonts to version 1.1.1 or later. If patching immediately is not possible, sanitize font file names to strip shell metacharacters before processing.

shell

$ npm install @offactory/compress-fonts@^1.1.1

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110648