Threat briefs

The @offactory/compress-fonts package before version 1.1.1 is vulnerable to OS command injection via unquoted font file path interpolation in child_process.execSync.

Turnpress versions 0.4.2 and earlier are vulnerable to OS command injection via malicious .docx filenames passed to the pandoc conversion process.

Beganovich snappdf versions 1.1.0 through 6.0.x are vulnerable to OS command injection via the setUrl() function on Windows, allowing unauthenticated attackers to achieve arbitrary code execution.

The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function allowing arbitrary command execution via crafted filenames.

The @runnerty/executor-decompress package is vulnerable to OS command injection via crafted archive filenames, allowing arbitrary command execution within the Runnerty process context.

The buildebooks package before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute arbitrary system commands via crafted EPUB filenames.

MyReport Updater versions through 2.1.1 are vulnerable to local privilege escalation allowing low-privileged users to achieve SYSTEM execution via malicious DLL injection in osk.exe.

Report One MyReport Updater versions 2.1.1 and earlier contain an unauthenticated gRPC service vulnerability allowing remote attackers to hijack the update process and achieve SYSTEM-level code execution.

Kan versions 0.5.5 through 0.6.0 contain an unauthenticated SSRF vulnerability in the /api/download/attatchment endpoint that allows attackers to probe internal services and cloud metadata.

Papermerge Core versions through 3.5.3 contain a missing authorization vulnerability allowing authenticated users to manipulate or process documents belonging to other users via predictable API endpoints.

Swetrix Cloud versions before 5.1.0 contain a missing authorization vulnerability in the ProjectController component that allows authenticated attackers to hijack arbitrary projects.

SmsForwarder through version 3.5.0 contains a missing authentication vulnerability in its embedded AndServer HTTP server, allowing attackers to remotely control the application and access sensitive data.

NullHub versions through 2026.5.29 contain a missing authentication vulnerability allowing unauthenticated remote access to management API endpoints.

L-SMASH versions through 2.14.5 contain a double free vulnerability in the NALU importer, allowing remote attackers to trigger heap corruption via a crafted Annex-B elementary stream.

Kaneo versions before 2.1.6 contain a missing authorization vulnerability (CVE-2025-71433) allowing authenticated users to bypass membership checks and perform unauthorized operations on arbitrary workspaces.

Gravitee API Management versions up to 4.12.22 allow unauthenticated remote attackers to forge JWTs using a default signing secret to impersonate any user, including administrators.

Cloud Commander versions 19.20.2 through 19.21.1 are vulnerable to a path traversal flaw in the GET /api/v1/pack endpoint allowing unauthenticated file exfiltration.

The thumbnail Python package through version 1.5 is vulnerable to OS command injection in the generate_thumbnail() function, enabling arbitrary code execution via shell metacharacter injection into system calls.

Stills versions prior to 25.24.2 are vulnerable to OS command injection via crafted media file paths containing shell metacharacters, enabling arbitrary command execution with Node.js process privileges.

Video-stitch versions prior to 2.0.0-beta.1 contain an OS command injection vulnerability allowing attackers to achieve remote code execution by injecting shell metacharacters into file name parameters processed by ffmpeg.

The nodejs-whisper package through version 0.3.1 contains an OS command injection vulnerability in the convertToWavType() function that allows unauthenticated command execution via crafted audio file paths.

The transcribe2texts package through version 1.0.6 is vulnerable to OS command injection via the transcribeAudio function, allowing unauthenticated attackers to achieve arbitrary code execution by injecting shell metacharacters into the audioPath parameter.

The whisper-node library through version 1.1.1 is vulnerable to OS command injection via unsanitized input in the whisper() function, allowing attackers to execute arbitrary shell commands.

The @mborne/extract library before version 0.2.1 is vulnerable to OS command injection via unsanitized archivePath or targetDir inputs passed to shelljs exec().

The doc-recog library through version 1.1.6 is vulnerable to OS command injection via crafted document paths passed to the recog() or tag() functions.

The pypdftk library (<= 0.5) is vulnerable to OS command injection via insecure path handling in its core functions, allowing arbitrary command execution when using subprocess.Popen.

The webp-converter package before 3.0.0 is vulnerable to OS command injection due to unsafe execution of libwebp binaries via execFile with shell enabled.

The git-diff package before 2.0.7 is vulnerable to OS command injection via the gitDiff API, allowing arbitrary command execution with Node.js process privileges through crafted input strings.

The vlife application through version 2.0.1 contains a hardcoded HS256 JWT signing key in TokenUtil, allowing unauthenticated attackers to forge tokens and gain administrative privileges.

The office-converter library through version 1.0.2 is vulnerable to OS command injection via the fileName parameter, allowing arbitrary code execution with Node.js process privileges.