CVE-2026-110635

Deferred Deferred - Pending Action

OS Command Injection in webp-converter

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110635

EUVD

EUVD-2026-101263

Affected Vendors & Products

Vendor	Product	Version / Range
scionoftech	webp-converter	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in the webp-converter library before version 3.0.0. It occurs because the library uses execFile with shell enabled to run libwebp binaries like cwebp or dwebp. Attackers can inject shell metacharacters through filenames or option strings, allowing arbitrary OS command execution as the Node.js process.

Detection Guidance

To detect this vulnerability, check if your system uses webp-converter versions before 3.0.0. Run: npm list webp-converter. If the version is less than 3.0.0, the system is vulnerable. Also inspect any scripts or applications using webp-converter functions like cwebp, dwebp, gwebp, or webpmux for command injection attempts in logs or inputs.

Impact Analysis

If you use a vulnerable version of webp-converter, attackers could execute arbitrary commands on your system by tricking you into processing a malicious file or option. This could lead to data theft, system compromise, or further network attacks depending on the permissions of the Node.js process.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately update webp-converter to version 3.0.0 or later using: npm install webp-converter@latest. If updating is not possible, remove or disable the library until patched. Review all scripts using webp-converter functions to ensure no untrusted input is passed to options or filenames.

Hi! I’m here to help you understand CVE-2026-110635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70