{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awebp-converter_projectwebp-converternode.js/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webp-converter_project:webp-converter:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110635"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["webp-converter (\u003c 3.0.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe webp-converter package prior to version 3.0.0 contains an OS command injection vulnerability located within the src/webpconverter.js helper functions. The vulnerability originates from the package's implementation of libwebp binary execution, specifically using Node.js execFile methods with shell-enabled parameters. This flaw allows an attacker who can influence the input arguments, such as file paths or conversion options passed to cwebp, dwebp, gwebp, or webpmux, to escape the intended binary execution context and inject arbitrary OS commands. Successful exploitation results in remote code execution under the privileges of the Node.js process, posing a significant risk to applications that process user-supplied image files or configurations using this library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application using webp-converter (\u0026lt; 3.0.0) to process image uploads or user-defined conversion settings.\u003c/li\u003e\n\u003cli\u003eAttacker provides a crafted input string (e.g., a malicious filename or option) containing shell metacharacters such as semicolon, pipe, or ampersand.\u003c/li\u003e\n\u003cli\u003eThe target application passes this attacker-controlled input to one of the affected helper functions (cwebp, dwebp, gwebp, or webpmux).\u003c/li\u003e\n\u003cli\u003eThe src/webpconverter.js module triggers an execFile operation with the shell option enabled, failing to sanitize the inputs.\u003c/li\u003e\n\u003cli\u003eThe underlying shell interpreter parses the metacharacters and executes the injected payload alongside or instead of the intended binary command.\u003c/li\u003e\n\u003cli\u003eArbitrary commands execute in the context of the Node.js application process, leading to system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote code execution. This vulnerability is applicable to any environment running a Node.js application that integrates webp-converter, potentially impacting web servers, file processing microservices, and image manipulation pipelines. The CVSS base score of 9.8 reflects the high potential for full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate webp-converter to version 3.0.0 or later to apply the security patch.\u003c/li\u003e\n\u003cli\u003eAudit application code for any unsanitized user inputs that are subsequently passed as arguments to webp-converter functions.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or allowlisting for all filenames and configuration options processed by image conversion utilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:33:04Z","date_published":"2026-10-14T16:33:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-webp-converter-cve/","summary":"The webp-converter package before 3.0.0 is vulnerable to OS command injection due to unsafe execution of libwebp binaries via execFile with shell enabled.","title":"OS Command Injection in webp-converter via libwebp Helpers","url":"https://feed.craftedsignal.io/briefs/2026-10-webp-converter-cve/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:webp-Converter_project:webp-Converter:*:*:*:*:*:node.js:*:*","version":"https://jsonfeed.org/version/1.1"}