{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/compress-fonts--1.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:offactory:compress-fonts:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-110648"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["compress-fonts (\u003c 1.1.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["offactory"],"content_html":"\u003cp\u003eThe @offactory/compress-fonts package before version 1.1.1 contains an OS command injection vulnerability (CVE-2026-110648). The flaw exists because the library takes user-supplied font file paths and interpolates them directly into a shell command string without proper quoting or sanitization. This string is then executed via the Node.js child_process.execSync function. By providing a font file with a maliciously crafted name containing shell metacharacters (such as backticks, semicolons, or pipe symbols), an attacker can cause the underlying system to execute arbitrary commands with the privileges of the application process. This vulnerability is particularly critical for server-side applications that process user-uploaded font files for compression.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote attackers to execute arbitrary shell commands on the hosting environment. This can lead to full system compromise, data exfiltration, or the deployment of persistent malware depending on the privileges of the Node.js process. As this is a library-level vulnerability, any application utilizing this package to process untrusted font inputs is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @offactory/compress-fonts dependency to version 1.1.1 or later.\u003c/li\u003e\n\u003cli\u003eAudit applications using this package to identify if they process font files from untrusted user sources.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement strict allowlisting for file names and paths before they are passed to the compress-fonts library functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:38:15Z","date_published":"2026-10-14T16:38:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-compress-fonts-rce/","summary":"The @offactory/compress-fonts package before version 1.1.1 is vulnerable to OS command injection via unquoted font file path interpolation in child_process.execSync.","title":"Command Injection in @offactory/compress-fonts","url":"https://feed.craftedsignal.io/briefs/2026-10-compress-fonts-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Compress-Fonts (\u003c 1.1.1)","version":"https://jsonfeed.org/version/1.1"}