ppt2png: OS command injection via input and output paths
Summary
The ppt2png npm library up to version 0.0.6 builds shell commands by concatenating file path arguments into calls to child_process.exec(). An attacker who can supply input or output paths can append shell metacharacters such as ';' and run arbitrary operating system commands with the privileges of the Node.js process. The risk is mainly relevant for applications that pass untrusted files to the library, such as web upload or document conversion features. The project is unmaintained and no fix is available.
Affected
- tzwm ppt2png, versions 0 to 0.0.6 (including the latest published version 0.0.6)
Fixed in
Unknown. No fixed version or vendor advisory was found, and the project has had no releases for about 12 years.
Workaround
- Remove or replace ppt2png where possible.
- Do not pass untrusted files or paths to ppt2png.
- If it must stay in use, run the conversion in an isolated container or sandbox with no network access and minimal file permissions.
- Developers: replace exec() with execFile() or spawn() using argument arrays, and validate path arguments, as proposed in the public report.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No known exploitation in the wild according to the sources reviewed.
- Public proof of concept: not confirmed. A referenced GitHub gist was not reviewed.
- EPSS is low (about 0.0147 according to one aggregator).
Our recommendation
- Search application code and lockfiles (package.json, package-lock.json) for ppt2png.
- Check whether any internet-facing feature passes user files to it.
- Plan removal or replacement, as no fix exists.
- Until then, run conversions only in an isolated environment without privileged access.
- Monitor NVD, VulnCheck and the GitHub repository for a fix or proof of concept.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Public report (GitHub Gist) gist.github.com
- ppt2png repository github.com
- ppt2png.js at referenced commit github.com
- ppt2png npm package www.npmjs.com
- Strix CVE summary www.strix.ai
- OffSeq radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:57.
Original description (NVD)
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.