CVE-2026-110648: @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through childprocess.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @offactory/compress-fonts before 1.1.1 are exposed when they process font files whose names can be influenced by an attacker. Commands run with the privileges of the Node.js process.
What does an attacker need to exploit it?
An attacker needs to supply a font file with a crafted filename containing shell metacharacters and cause the application to process that file. The issue is local in the supplied vector, but it requires no privileges and user interaction is required.
Are default deployments affected?
The available information does not identify a configuration prerequisite. The vulnerable behavior occurs when a font path is passed unquoted into a FontForge command through child_process.execSync.
How can I determine whether my application is affected?
Check whether it uses @offactory/compress-fonts at a version earlier than 1.1.1 and processes font files from attacker-influenced locations or uploads. Review whether those filenames can contain shell metacharacters before being passed to the package.
What can be done if upgrading is not immediately possible?
Do not process untrusted font filenames, and restrict accepted filenames to a safe character set that excludes shell metacharacters. Running the Node.js process with minimal privileges limits the privileges available to injected commands.