Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-107703@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

Critical 9.8

In plain English

A critical-severity OS command injection in @enmaso/node-convert from enmaso. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.8%top 20.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.

Affected products (as reported)

Vendor	Product	Versions
enmaso	@enmaso/node-convert	0 – through 1.0.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://gist.github.com/R3tro16/5a508fcfddfb0dfe66a0a53437ede74c third-party-advisory
https://github.com/enmaso/node-convert/blob/143e4d76244e2daac57eef59d8ed5983e33ee4fb/convert.js#L4-L15 technical-description
https://github.com/enmaso/node-convert product
VulnCheck Advisory: @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo third-party-advisory