webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile…
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Node.js
- Product
- ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js
- CVSS
- 9.8
- EPSS
- 0.025 (p85)
- Exposure class
- Developer platform
Why it ranks 23 (Routine)
- CVSS 9.8 critical
- Product class: developer platform
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.