CVE record · 1 source
CVE-2026-110648
CVSS 7.8@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying…
- Vendor
- Node.js
- Product
- Node.js
- CVSS
- 7.8
- Exposure class
- Developer platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying…
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a…