CVE-2026-110635 in webp-converter
Summary
by MITRE • 10/14/2026
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in versions of webp-converter prior to 3.0.0 represents a critical security flaw rooted in improper neutralization of special elements used in an operating system command, commonly referred to as OS Command Injection. This specific weakness allows attackers with the ability to control file names or option strings passed to various image processing functions such as cwebp, dwebp, gwebp, and webpmux to inject shell metacharacters into the execution context of the Node.js process. The root cause lies in the implementation details within src/webpconverter.js helpers, where external binaries from the libwebp library are executed using the execFile function with the shell option explicitly enabled. This configuration choice fundamentally alters how arguments are processed by the underlying operating system, transforming what should be treated as literal data into executable commands that can manipulate the host environment if malicious input is introduced.
From a technical perspective, the use of execFile with shell enabled bypasses the safer argument parsing mechanisms typically associated with direct binary execution. When the shell option is true, the arguments are passed to the system's command interpreter rather than directly to the binary executable. This means that any special characters present in user-supplied input, such as semicolons, pipes, ampersands, or backticks, will be interpreted by the shell as control operators for chaining commands or performing subshell executions. An attacker who can influence the file name path or specific conversion options provided to these helper functions can therefore construct a payload that terminates the intended command and initiates arbitrary system-level operations. This effectively grants the attacker code execution capabilities equivalent to those of the user account running the Node.js application, which often leads to full system compromise depending on the privileges assigned to the service process.
The operational impact of this vulnerability is severe, particularly for applications relying on webp-converter to handle untrusted image uploads or dynamic file processing workflows. If an attacker can control any part of the input data that flows into these helper functions without adequate sanitization or validation, they can achieve remote code execution (RCE). This could lead to unauthorized access to sensitive files stored on the server, modification of application logic through script injection, or use of the compromised host as a pivot point for further network attacks. In cloud-native environments or containerized deployments where such libraries are frequently used in image processing pipelines, this vulnerability poses a significant risk to data integrity and confidentiality, potentially allowing lateral movement across internal networks if the Node.js process has broad filesystem permissions.
This flaw aligns with CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, highlighting the failure to validate or escape user-supplied input before passing it to a system shell. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this vulnerability facilitates techniques associated with Execution via Remote Services and potentially Defense Evasion if attackers use obfuscated commands within their payloads. To mitigate this risk, developers must upgrade immediately to version 3.0.0 or later of webp-converter where the underlying implementation has been corrected to avoid shell interpretation risks. For applications unable to update instantly, a temporary mitigation involves strictly validating and sanitizing all file paths and option strings against a whitelist of allowed characters before they are passed to any helper function. Additionally, ensuring that the Node.js process runs with minimal necessary privileges can limit the blast radius should an injection attempt succeed, although upgrading remains the only definitive remediation for this architectural flaw.