CVE-2026-110648 in compress-fonts
Summary
by MITRE • 10/14/2026
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The @offactory/compress-fonts library prior to version 1.1.1 is susceptible to an Operating System Command Injection vulnerability due to improper neutralization of special elements used in an operating system command, commonly known as CWE-78. This security flaw arises from the way the software handles file paths associated with font files during compression operations. Specifically, when processing fonts, the library constructs a shell command by interpolating the user-supplied or filesystem-derived font path directly into a string that is subsequently passed to Node.js's child_process.execSync function without proper quoting or sanitization of special characters. This architectural decision creates a direct pathway for an attacker to inject arbitrary operating system commands if they can control the filename used in the compression process.
The technical mechanism behind this vulnerability relies on the behavior of shell interpreters, such as bash or sh, which are invoked by child_process.execSync when executing string-based command arguments. Shell metacharacters like semicolons, ampersands, pipes, and backticks have special meanings that allow for command chaining and execution flow control. Because the font path is interpolated unquoted into the command string, any shell metacharacter present in a crafted filename will be interpreted by the shell as part of the command structure rather than literal data. For instance, if an attacker provides a file named test.ttf; rm -rf /, the resulting command executed by Node.js would not merely attempt to compress a font with that name but would instead execute the compression tool followed immediately by the destructive removal of files on the system. This bypasses any intended logic within the library and grants the injected commands full execution context.
The operational impact of this vulnerability is severe, particularly in environments where the Node.js process runs with elevated privileges or has access to sensitive data. An attacker who can influence the font file names processed by this library could achieve Remote Code Execution (RCE) on the host system. This aligns with MITRE ATT&CK technique T1059, specifically sub-technique 004 which covers Command and Scripting Interpretation. The extent of damage depends entirely on the permissions of the user account running the Node.js application. If the service runs as root or an administrator, the attacker gains complete control over the system, potentially leading to data exfiltration, installation of persistent backdoors, lateral movement within a network, or denial of service through resource exhaustion and file deletion. Even in less privileged contexts, attackers can often escalate privileges by exploiting other local vulnerabilities once initial code execution is achieved.
Mitigation for this vulnerability requires immediate updates to the affected library version 1.1.1 or later, where the developers have likely implemented proper input sanitization or switched to safer API calls that do not invoke a shell interpreter directly. For applications unable to update immediately, defensive coding practices must be employed. Developers should avoid using child_process.execSync with user-controllable strings and instead use child_process.spawn which accepts arguments as an array of separate parameters, thereby preventing the shell from interpreting metacharacters in file names. Additionally, implementing strict input validation that rejects filenames containing shell special characters can provide a layer of defense-in-depth. Regular security audits focusing on command injection vectors are essential to ensure that no other parts of the application expose similar risks through improper string interpolation into system commands.