CVE-2026-110635: webp-converter before 3.0.0 OS Command Injection via File Names and Options
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
webp-converterto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
What application paths are exposed to this issue?
Any Node.js application using an affected version that passes attacker-controlled file names or option strings to the cwebp, dwebp, gwebp, or webpmux helper functions is exposed.
What does an attacker need to exploit it?
The attacker needs control over a file name or option string supplied to one of the affected conversion helpers. No authentication or user interaction is required according to the provided severity vector.
What access could successful exploitation provide?
Injected shell commands execute with the permissions of the Node.js process running webp-converter. The reported impact includes high confidentiality, integrity, and availability effects.
What is the available fix?
Upgrade webp-converter to version 3.0.0 or later. Versions before 3.0.0 are identified as affected.