CVE-2026-110635: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in scionoftech webp-converter
Description
webp-converter versions before 3.0.0 contain a critical OS command injection vulnerability. This flaw exists in the src/webpconverter.js helpers that run libwebp binaries using execFile with shell enabled. An attacker who can control file names or option strings passed to certain functions can inject shell metacharacters to execute arbitrary OS commands with the privileges of the Node.js process.
CVSS v4.0
Score 9.3critical
Affected software
scionoftech
webp-converter
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110635 describes an OS command injection vulnerability in the scionoftech webp-converter package prior to version 3.0.0. The vulnerability arises because the helper functions in src/webpconverter.js invoke libwebp binaries (cwebp, dwebp, gwebp, webpmux) via execFile with shell enabled, allowing untrusted input (file names or option strings) to inject shell metacharacters. This enables attackers to execute arbitrary operating system commands in the context of the Node.js process running the package.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary OS commands remotely with the privileges of the Node.js process using the vulnerable webp-converter package. This can lead to full system compromise depending on the environment and privileges of the Node.js process.
Mitigation Recommendations
Upgrade webp-converter to version 3.0.0 or later, where this OS command injection vulnerability has been fixed. If upgrading is not immediately possible, avoid passing untrusted input to the affected functions or disable shell execution if configurable. Patch status is not explicitly confirmed in the provided data, but the affectedVersions indicate the issue is fixed starting from 3.0.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T13:07:31.763Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acf92f22cdf04f6568a3938
Added to database: 10/14/2026, 14:34:26 UTC
Last enriched: 10/14/2026, 14:49:08 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.