CVE-2026-110648

Deferred Deferred - Pending Action

OS Command Injection in @offactory/compress-fonts

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110648

EUVD

EUVD-2026-101276

Affected Vendors & Products

Vendor	Product	Version / Range
adamarcanov	compress-fonts	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in the @offactory/compress-fonts library before version 1.1.1. Attackers can execute shell commands by providing font files with crafted names containing shell metacharacters. The library uses child_process.execSync to run FontForge commands, and unquoted font paths allow command injection through filename manipulation.

Detection Guidance

Check if the @offactory/compress-fonts package version is below 1.1.1 by running: npm list @offactory/compress-fonts. If vulnerable, look for suspicious font files with names containing shell metacharacters like semicolons or ampersands in directories processed by the library.

Impact Analysis

An attacker could execute arbitrary commands on your system with the privileges of the Node.js process running compress-fonts. This could lead to data theft, system compromise, or further network infiltration if the Node.js process has elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Compliance may be compromised if systems processing sensitive data are affected.

Mitigation Strategies

Upgrade the @offactory/compress-fonts package to version 1.1.1 or later using: npm update @offactory/compress-fonts. Avoid processing untrusted font files until the update is applied.

Hi! I’m here to help you understand CVE-2026-110648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70