CVE-2026-107703: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in enmaso @enmaso/node-convert

@enmaso/node-convert versions up to and including 1.0.0 are vulnerable to OS command injection via unsanitized inputs in convert.js. The vulnerability arises because user-controlled filepath and convertTo parameters are directly incorporated into shell commands executed by child_process.exec(), allowing injection of shell metacharacters or quotes. This enables remote attackers to execute arbitrary OS commands with Node.js process privileges.

Successful exploitation allows an attacker to execute arbitrary operating system commands on the host running the vulnerable Node.js application. This can lead to full system compromise, data theft, or disruption of service. The CVSS 4.0 score of 9.3 reflects the critical severity and the fact that no privileges or user interaction are required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions of @enmaso/node-convert or implement input sanitization and command execution safeguards to prevent injection. Monitor vendor channels for updates.