Attack Chain

1. Attacker identifies an application using webp-converter (< 3.0.0) to process image uploads or user-defined conversion settings.
2. Attacker provides a crafted input string (e.g., a malicious filename or option) containing shell metacharacters such as semicolon, pipe, or ampersand.
3. The target application passes this attacker-controlled input to one of the affected helper functions (cwebp, dwebp, gwebp, or webpmux).
4. The src/webpconverter.js module triggers an execFile operation with the shell option enabled, failing to sanitize the inputs.
5. The underlying shell interpreter parses the metacharacters and executes the injected payload alongside or instead of the intended binary command.
6. Arbitrary commands execute in the context of the Node.js application process, leading to system compromise.

Impact

Successful exploitation allows unauthenticated remote code execution. This vulnerability is applicable to any environment running a Node.js application that integrates webp-converter, potentially impacting web servers, file processing microservices, and image manipulation pipelines. The CVSS base score of 9.8 reflects the high potential for full system compromise.

Recommendation

• Update webp-converter to version 3.0.0 or later to apply the security patch.
• Audit application code for any unsanitized user inputs that are subsequently passed as arguments to webp-converter functions.
• Implement strict input validation or allowlisting for all filenames and configuration options processed by image conversion utilities.