webp-converter before 3.0.0 contains a critical OS command injection flaw (CVSS 3.1: 9.8). An attacker who controls file names or option strings can run OS commands with the privileges of the Node.js process.
What Is It
CVE-2026-110635 is an OS command injection vulnerability (CWE-78) in webp-converter, an npm package maintained by scionoftech. The flaw is in the helpers in src/webpconverter.js that run the libwebp binaries through execFile with the shell enabled.
The affected functions wrap the cwebp, dwebp, gwebp and webpmux binaries. Because a shell is used, an attacker who can control file names or option strings passed to these functions can inject shell metacharacters. The injected commands run as the Node.js process.
Why It Matters
VulnCheck, the CNA, rates this flaw critical:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
The scoring reflects network attack vector, low attack complexity, no privileges required and no user interaction. The impact on confidentiality, integrity and availability is rated high.
Image conversion is often driven by user-supplied uploads and parameters. Any application that passes untrusted file names or conversion options to this library may be exposed to arbitrary command execution on the host.
There is currently no CISA KEV entry for this CVE, so active exploitation in the wild is not confirmed. NVD lists the record's status as "Received" as of publication on 2026-10-14.
What's Vulnerable
- Vendor: scionoftech
- Product: webp-converter (
pkg:npm/webp-converter) - Affected versions: all versions before 3.0.0 (semver
0to<3.0.0) - Vulnerable code: helper functions in
src/webpconverter.jsthat callcwebp,dwebp,gwebpandwebpmux
Patch Status
The affected range ends below 3.0.0, which indicates the issue is fixed in webp-converter 3.0.0. The maintainer's repository references a fix commit, pull request #53 and an updated CHANGELOG.
Recommended action: Upgrade webp-converter to version 3.0.0 or later. Audit your dependency trees, including transitive dependencies, for older versions. Until you upgrade, make sure no untrusted input reaches file name or option arguments passed to the library's conversion functions.