CVE-2026-107699
ppt2png through 0.0.6 OS Command Injection via input and output paths
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.
| CWE | CWE-78 |
| Vendor | tzwm |
| Product | ppt2png |
| Published | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for tzwm ppt2png
Be the first to know when new critical vulnerabilities affecting tzwm ppt2png are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
tzwm / ppt2png
0 ≤ 0.0.6
References
gist.github.com: https://gist.github.com/R3tro16/2daadc08b282c48d41203d1125d7632a github.com: https://github.com/tzwm/ppt2png/blob/8c68eba7af943de27422b12c6e224d28587af7ae/ppt2png.js#L5-L35 github.com: https://github.com/tzwm/ppt2png vulncheck.com: https://www.vulncheck.com/advisories/ppt2png-through-0.0.6-os-command-injection-via-input-and-output-paths
Credits
William Pierson (Retro16)