OS command injection in ppt2png via input and output paths
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
The tzwm ppt2png package through 0.0.6 contains an OS command injection flaw (CWE-78) in which unsanitized input or output path arguments reach child_process.exec() in ppt2png.js. An unauthenticated remote attacker can inject shell metacharacters into file names to run operating system commands with Node.js process privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for ppt2png.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107699
- 2026-10-14 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences