CVE-2026-107699: ppt2png through 0.0.6 OS Command Injection via input and output paths
Published Oct 8, 2026
·Updated
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec() in ppt2png.js, running commands with Node.js process privileges.
Affected Software
1 affected component
npm/ppt2png<=0.0.6
Event History
Oct 8, 2026
CVE Published
via MITRE·06:36 PM
Data Sourced
via MITRE·06:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions should be treated as affected?
ppt2png version 0.0.6 and earlier are affected.
2
What level of attacker access is needed to exploit this issue?
An attacker needs to be able to supply an input or output path argument. The vulnerable code passes these unsanitized paths to child_process.exec(), allowing shell metacharacters such as semicolons in file names to append commands.
3
What privileges would injected commands receive?
Injected commands run with the privileges of the Node.js process executing ppt2png.