EXPOSURES › CVE-2026-110635
CVE-2026-110635
CRITICALwebp-converter before 3.0.0 allows OS command injection via shell metacharacters in libwebp binary execution.
The vulnerability enables attackers to execute arbitrary OS commands as the Node.js process by injecting shell metacharacters into file names or option strings passed to webp conversion functions. This is a critical RCE flaw that violates NIST 800-171 requirements for preventing unauthorized access and command execution, requiring immediate patching and input validation reviews. DIB organizations must verify all third-party libraries for similar execFile shell-enabled calls.
Shame score — A critical OS command injection flaw in a widely used webp-conversion library demonstrates avoidable negligence in secure coding practices, allowing attackers to execute arbitrary commands as the Node.js process.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.