Cve-2026-107699 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-107699/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 08 Oct 2026 19:39:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOS Command Injection in ppt2png Libraryhttps://feed.craftedsignal.io/briefs/2026-10-ppt2png-rce/Thu, 08 Oct 2026 19:39:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ppt2png-rce/The ppt2png npm package (version 0.0.6 and earlier) is vulnerable to OS command injection via unsanitized file path arguments passed to child_process.exec(), enabling arbitrary code execution.The ppt2png npm package version 0.0.6 and earlier contains a critical OS command injection vulnerability, identified as CVE-2026-107699. The vulnerability stems from improper sanitization of user-supplied input and output path arguments within the ppt2png.js module. Specifically, the library uses the Node.js child_process.exec() function to execute system commands, but it fails to escape or sanitize shell metacharacters provided in filename parameters. An attacker can exploit this by injecting characters like the semicolon (;) into an argument, allowing them to terminate the intended command and append malicious OS commands. These commands execute with the same privileges as the Node.js application process. This vulnerability presents a high risk to any application using the library to process user-provided file paths, potentially leading to full system compromise depending on the process context.

Impact

Successful exploitation allows for arbitrary code execution on the server hosting the application. This could result in unauthorized data access, exfiltration of sensitive information, or the deployment of persistent malware within the infrastructure of organizations utilizing the vulnerable package in their software supply chain.

Recommendation

  • Identify all applications utilizing the ppt2png npm package version 0.0.6 or earlier and update to a remediated version if available.
  • If no patched version exists, implement input validation to sanitize all filenames and file path arguments, rejecting any strings containing shell metacharacters such as ;, |, &, $, or >.
  • Run the Node.js application process with the least privilege possible to minimize the impact of potential command execution.
]]>criticaladvisorysupply-chaincommand-injectionnodejscve-2026-107699