Key points
- The National Vulnerability Database rates CVE-2026-110635 as critical with a CVSS score of 9.3.
- Versions of the scionoftech webp-converter library before 3.0.0 are affected by this OS command injection issue.
- Attackers can execute commands as the Node.js process by injecting shell metacharacters into function arguments.
Security teams using the scionoftech webp-converter Node.js library must assess their exposure immediately. The National Vulnerability Database has assigned CVE-2026-110635 to this flaw, rating it as critical with a score of 9.3. Any deployment running a version before 3.0.0 is considered vulnerable to remote command execution.
In plain English
The webp-converter library helps Node.js applications process WebP image files. It works by calling external binaries from the libwebp suite, such as cwebp, dwebp, gwebp, and webpmux. The code in src/webpconverter.js uses a method that enables the shell when running these commands. This design choice creates a dangerous gap in how input is handled.
The background
When the library passes file names or option strings to these binaries, it does not properly sanitize the input. An attacker who can control these strings can insert special shell characters. These metacharacters trick the system into treating part of the image path as a command. As Vuln Post reported on 2026-10-14 regarding similar flaws, such injection risks require urgent attention.
What changes now
The vulnerability allows full OS command execution as the Node.js process user. This means an attacker could potentially read sensitive files, install malware, or pivot to other systems. The flaw exists in the helper functions that bridge the JavaScript environment and the underlying operating system binaries. The source material does not confirm the availability of a fix.
Who needs to act first
Teams should prioritize systems that accept user-supplied filenames or image options. Check inventory for any Node.js projects importing webp-converter versions older than 3.0.0. If you cannot update immediately, restrict input validation at the application layer to block shell metacharacters. Ensure that the Node.js process runs with minimal privileges to limit the blast radius of any successful injection attempt.
Background: Input validation
Input validation cyber security requires checking every piece of data entering a system for type, length, and format. You must reject unexpected data immediately. This prevents attackers from injecting malicious code or causing system crashes. Trusting user input without strict rules allows breaches to occur.
Read the full guide: Input Validation Cyber Security: Stop Code Injection Before It Starts
What to do and how to stay safe: webp-converter
- Audit your Node.js dependency trees to identify any usage of webp-converter versions before 3.0.0.
- Implement strict input validation to reject filenames or options containing shell metacharacters like semicolons or pipes.
- Run the affected Node.js processes with the least privilege possible to limit the impact of command execution.
- Monitor system logs for unexpected binary executions or unusual process spawns that might indicate exploitation attempts.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of webp-converter are vulnerable?
All versions of the scionoftech webp-converter library before version 3.0.0 are affected by CVE-2026-110635.
How do attackers exploit this vulnerability?
Attackers inject shell metacharacters into file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions.
What is the severity rating for CVE-2026-110635?
The National Vulnerability Database rates this critical OS command injection flaw with a CVSS score of 9.3.
