Offactory - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/offactory/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 16:38:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Injection in @offactory/compress-fontshttps://feed.craftedsignal.io/briefs/2026-10-compress-fonts-rce/Wed, 14 Oct 2026 16:38:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-compress-fonts-rce/The @offactory/compress-fonts package before version 1.1.1 is vulnerable to OS command injection via unquoted font file path interpolation in child_process.execSync.The @offactory/compress-fonts package before version 1.1.1 contains an OS command injection vulnerability (CVE-2026-110648). The flaw exists because the library takes user-supplied font file paths and interpolates them directly into a shell command string without proper quoting or sanitization. This string is then executed via the Node.js child_process.execSync function. By providing a font file with a maliciously crafted name containing shell metacharacters (such as backticks, semicolons, or pipe symbols), an attacker can cause the underlying system to execute arbitrary commands with the privileges of the application process. This vulnerability is particularly critical for server-side applications that process user-uploaded font files for compression.

Impact

Successful exploitation allows remote attackers to execute arbitrary shell commands on the hosting environment. This can lead to full system compromise, data exfiltration, or the deployment of persistent malware depending on the privileges of the Node.js process. As this is a library-level vulnerability, any application utilizing this package to process untrusted font inputs is at risk.

Recommendation

  • Upgrade the @offactory/compress-fonts dependency to version 1.1.1 or later.
  • Audit applications using this package to identify if they process font files from untrusted user sources.
  • If upgrading is not immediately possible, implement strict allowlisting for file names and paths before they are passed to the compress-fonts library functions.
]]>highadvisory