office-converter (npm): OS command injection via file name

Summary

The Node.js package office-converter up to version 1.0.2 passes user-supplied file names unescaped into a shell command run via child_process.exec(). An attacker who can influence the file name passed to generatePdf() or generateHtml() can inject shell metacharacters such as $(...), backticks or quotes and execute arbitrary commands with the privileges of the Node.js process. The attack requires no authentication according to the CVSS vector, but only applies where an application forwards untrusted file names to the converter.

Affected

• vworld4u office-converter (npm), versions 0.0.0 to 1.0.2 (per CVE record and GitHub advisory)

Fixed in

• Unknown. No fixed version has been identified; the GitHub advisory states no fix is currently available.

Workaround

• No vendor workaround confirmed.
• Do not pass user-controlled file names to the converter; rename uploads to server-generated names before conversion.
• Validate file names against a strict allow-list as a stopgap.
• Run the converter as a low-privilege user in a container or sandbox with no access to secrets and restricted outbound network access.

Exploitation

• No evidence of active exploitation found; not known to be exploited in the wild.
• No public proof-of-concept identified in the sources reviewed.
• CISA SSVC assessment lists exploitation as PoC and automatable as yes.

Our recommendation

• Check whether office-converter is used in your applications (search code and lockfiles for office-converter).
• If it is used in an internet-facing or upload-driven service, treat this as high priority.
• Plan to replace the package, as no maintained fix is available.
• Until replaced, apply the workarounds above and monitor for unexpected child processes spawned by the Node.js service.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Advisory GHSA-9p64-h5q4-phpm github.com
• VulnCheck advisory www.vulncheck.com
• Vulnerable code (index.js) github.com
• Pull request #9 github.com
• VulDB entry vuldb.com
• Strix CVE record www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:11.