Vulnerability details
CVE-2026-110635
scionoftech webp-converter
webp-converter before 3.0.0 OS Command Injection via File Names and Options
CVSS 4.0
9.3Critical
Official description
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| scionoftech | webp-converter | v < 3.0.0 | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://github.com/scionoftech/webp-converter/pull/53 issue-trackingpatch
- https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605 vendor-advisorypatchissue-tracking
- https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a patch
- https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md release-notes
- https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52 technical-description
- https://github.com/scionoftech/webp-converter product
- https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-options third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-26
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 35 · Medium
Exploit prediction (EPSS)
2.52%
Probability of exploitation in 30 days
84.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')