Skip to content

CVE record · 1 source

CVE-2026-110635

CVSS 9.8

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile…

Vendor: Node.js
Product: ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js
CVSS: 9.8
EPSS: 0.025 (p85)
Exposure class: Developer platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 17d ago

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile…

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to…

CVSS 9.8 CVE-2026-110635 Node.js