CVE-2026-110635 scionoftech CVE debrief

Who should care

Node.js developers and administrators using the webp-converter library, especially those who handle file uploads or processing, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

Defenders should care about CVE-2026-110635 because it allows attackers to execute OS commands, potentially leading to unauthorized access, data breaches, or system compromise. Node.js developers and administrators handling file uploads or processing with webp-converter should verify their exposure, assess input sanitization and validation, and prioritize upgrading to version 3.0.0 or later.

• Potential execution of arbitrary OS commands
• Possible elevation of privileges
• Potential data breaches or unauthorized access
• Required verification of input sanitization and validation

Technical summary

The webp-converter library before version 3.0.0 is vulnerable to OS command injection. The vulnerability exists in the src/webpconverter.js file, where the library uses the execFile function with shell enabled to run libwebp binaries. An attacker controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.0.0 or later of webp-converter, reviewing and restricting file name and option inputs to these functions, and monitoring for suspicious activity.

Recommended defensive actions

• Verify and upgrade to version 3.0.0 or later of webp-converter
• Review and restrict file name and option inputs to cwebp, dwebp, gwebp, or webpmux functions
• Monitor for suspicious activity and implement compensating controls
• Perform vulnerability scanning and penetration testing to identify potential attack vectors
• Implement additional security measures such as input validation and sanitization
• Conduct regular security audits and risk assessments
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential attack vectors. However, limited information is available on actual exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.