Skip to content

CVE record · 1 source

CVE-2026-107703

CVSS 9.8

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via…

Vendor: Node.js
Product: ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js
CVSS: 9.8
EPSS: 0.018 (p79)
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 23d ago

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via…

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell…

CVSS 9.8 CVE-2026-107703 Node.js