OS command injection in webp-converter via file names and options
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
webp-converter before 3.0.0 contains an OS command injection flaw (CWE-78) in its src/webpconverter.js helpers, which run libwebp binaries through execFile with shell enabled. An unauthenticated remote attacker who controls file names or option strings passed to cwebp, dwebp, gwebp, or webpmux can inject shell metacharacters and run OS commands as the Node.js process.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| scionoftech | webp-converter | before 3.0.0 | 3.0.0 | Patch available | CNA |
- webp-converter Vendorscionoftech Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA
Remediation
Upgrade webp-converter to version 3.0.0, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA webp-converter (scionoftech) Fixed in 3.0.0
Timeline
- 2026-10-14 Threatist record created from CVE-2026-110635
- 2026-10-14 Alias added: GHSA-mpvc-jhp3-x7r5
- 2026-10-26 CISA SSVC decision points changed
References
Patch 3
Sources
- CVE-2026-110635 · CVE Program
- CVE-2026-110635 · NVD
- FIRST EPSS
- GHSA-mpvc-jhp3-x7r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences