Product
The webp-converter package before 3.0.0 is vulnerable to OS command injection due to unsafe execution of libwebp binaries via execFile with shell enabled.