webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.02521·Published 2026-10-14·Fixed in 3.0.0CWE-78