CVE-2026-110648 adamarcanov CVE debrief

Who should care

Defenders responsible for Node.js environments and the @offactory/compress-fonts package should assess exposure and prioritize remediation. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams who need to verify and remediate this vulnerability, particularly in Node.js environments. They should review font file names and paths for potential shell metacharacters and implement security

Why it matters

CVE-2026-110648 is an OS command injection vulnerability in @offactory/compress-fonts before 1.1.1, allowing attackers to execute shell commands via crafted font file names. Defenders should verify and remediate this vulnerability, particularly in Node.js environments.

• Potential execution of arbitrary shell commands with Node.js process privileges.
• Possible compromise of systems using vulnerable versions of @offactory/compress-fonts.
• Need for verification of font file names and paths for potential shell metacharacters.
• Priority on upgrading to version 1.1.1 or later.

Technical summary

The @offactory/compress-fonts package before version 1.1.1 contains an OS command injection vulnerability. This vulnerability allows attackers to execute shell commands by supplying font files with crafted names. The font paths are interpolated unquoted into a FontForge command run through child_process.execSync, allowing shell metacharacters in file names to execute commands with the Node.js process privileges.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their environments, particularly those using Node.js and the @offactory/compress-fonts package.

Recommended defensive actions

• Verify the version of @offactory/compress-fonts in use and upgrade to 1.1.1 or later if necessary.
• Review font file names and paths for potential shell metacharacters.
• Implement additional security measures to restrict execution of shell commands.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the OS command injection vulnerability in @offactory/compress-fonts before 1.1.1, which allows attackers to execute shell commands by supplying font files with crafted names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.