webp-converter: OS command injection via file names and options
Summary
webp-converter, a Node.js library for converting images to and from WebP, passes file names and option strings to bundled libwebp binaries with shell enabled before version 3.0.0. An attacker who controls these values can inject shell metacharacters and run OS commands with the privileges of the Node.js process. The risk applies mainly when an application passes untrusted input to the library, for example in an image upload feature.
Affected
- webp-converter (npm) before 3.0.0
- Per the CVE record, versions 0 to below 3.0.0 are affected.
Fixed in
- 3.0.0 (per CNA data; the fix content and the npm release have not been independently verified)
Workaround
- No vendor-documented workaround.
- Do not pass user-controlled file names or option strings to the library.
- Generate internal file names and use fixed option values.
- Run the Node.js process with least privilege.
Exploitation
- No known exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept found.
- EPSS 0.02521.
Our recommendation
- Identify webp-converter in Node.js projects, for example with npm ls webp-converter.
- Check whether user input reaches file names or options.
- Upgrade to 3.0.0 or later after checking the changelog, or replace the library.
- Until then, remove user control over file names and options.
- The repository is marked deprecated; plan a replacement if no maintained version is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record via VulnCheck advisory www.vulncheck.com
- webp-converter repository github.com
- Vulnerable code in src/webpconverter.js github.com
- Fix commit f1b6724 github.com
- CHANGELOG.md github.com
- Pull request #53 github.com
- OSV entry CVE-2026-110635 osv.dev
- VulDB entry 420022 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:06.
Original description (NVD)
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
NVD references (7)
- https://github.com/scionoftech/webp-converter
- https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter…
- https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md
- https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a
- https://github.com/scionoftech/webp-converter/pull/53
- https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605
- https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-opti…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.