CVE-2026-110635
webp-converter before 3.0.0 OS Command Injection via File Names and Options
scionoftech webp-converter
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)2.52%Chance of exploitation activity in the next 30 days, higher than 84% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.0webp-converterCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Text from CVE List
Affected versions 1
- webp-converteraffected: all versions before 3.0.0CVE List
References 7
- github.com/scionoftech/webp-converter/pull/53Fixvia CVE List
- github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605Fixvia CVE List
- github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928aFixvia CVE List
- github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.mdFixvia CVE List
- vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-optionsAdvisoryvia CVE List
- github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52Referencevia CVE List
- github.com/scionoftech/webp-converterReferencevia CVE List