CVE-2026-110648: compress-fonts (@offactory): OS command injection via font file names

Summary

The npm package @offactory/compress-fonts before 1.1.1 passes font file paths unquoted into a FontForge shell command run via execSync. An attacker who can supply a font file with a crafted file name can execute arbitrary shell commands with the privileges of the Node.js process. The attack requires a user or process to convert the crafted font file, for example through an upload feature or a build pipeline with untrusted input.

Affected

@offactory/compress-fonts versions before 1.1.1 (CVE record: affected 0 to < 1.1.1)
CVSS 4.0 base score 8.5 (HIGH), vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; other sources list CVSS 3.1 7.8

Fixed in

Version 1.1.1 (according to the fix pull request; not yet verified on the npm registry)
Fix commit 12002e5866af2163cd34424baae5a53338951a5d replaces execSync with execFileSync and passes arguments as an array

Workaround

Unknown. No vendor-published workaround found.
Do not pass untrusted file names to the library.
Rename uploaded files to server-generated names before processing.
Run the conversion step in an isolated container with minimal privileges.

Exploitation

RedPacket Security lists no known exploitation.
CISA SSVC assessment: exploitation none, automatable no, technical impact total.
A reproduction exists in the fix pull request on version 1.1.0; details are not published here.
Not in CISA KEV as far as searched; to be verified at cisa.gov.

Our recommendation

Inventory all repositories and CI images for the package with npm ls @offactory/compress-fonts.
Upgrade to 1.1.1 once the version is verified on the npm registry.
Review any service that converts user-supplied fonts and restrict or sanitize uploads.
Run the conversion in an isolated environment with minimal privileges.
Monitor for vendor advisories, as no GitHub Security Advisory has been published yet.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

VulnCheck advisory www.vulncheck.com
Fix pull request #1 github.com
Fix commit 12002e5 github.com
Vulnerable source file index.js github.com
CVE mirror (cve.threatint.com) cve.threatint.com
RedPacket Security CVE alert www.redpacketsecurity.com
npm package @offactory/compress-fonts www.npmjs.com
OSV entry CVE-2026-110648 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:34.

Original description (NVD)

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed