webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Scionoftech
  • Webp-converter

No data.

No data.

References
Link Providers
https://github.com/scionoftech/webp-converter cve-icon cve-icon
https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52 cve-icon cve-icon
https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md cve-icon cve-icon
https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a cve-icon cve-icon
https://github.com/scionoftech/webp-converter/pull/53 cve-icon cve-icon
https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605 cve-icon cve-icon
https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-options cve-icon cve-icon
History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Scionoftech
Scionoftech webp-converter
Vendors & Products Scionoftech
Scionoftech webp-converter

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Title webp-converter before 3.0.0 OS Command Injection via File Names and Options
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-14T14:17:07.752Z

Updated: 2026-10-26T16:10:32.954Z

Reserved: 2026-10-14T13:07:31.763Z

Link: CVE-2026-110635

cve-icon Vulnrichment

Updated: 2026-10-26T16:10:28.776Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T15:17:16.560

Modified: 2026-10-26T17:17:15.063

Link: CVE-2026-110635

cve-icon Redhat

No data.