Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110635webp-converter before 3.0.0 OS Command Injection via File Names and Options
Critical 9.8
In plain English
A critical-severity OS command injection in webp-converter from scionoftech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| scionoftech | webp-converter | 0 – before 3.0.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/scionoftech/webp-converter/pull/53 issue-tracking, patch
- https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605 vendor-advisory, patch, issue-tracking
- https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a patch
- https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md release-notes
- https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52 technical-description
- https://github.com/scionoftech/webp-converter product
- VulnCheck Advisory: webp-converter before 3.0.0 OS Command Injection via File Names and Options third-party-advisory