CVE-2026-107703
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.
| CWE | CWE-78 |
| Vendor | enmaso |
| Product | @enmaso/node-convert |
| Published | Oct 8, 2026 |
| Last Updated | Oct 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for enmaso @enmaso/node-convert
Be the first to know when new critical vulnerabilities affecting enmaso @enmaso/node-convert are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
enmaso / @enmaso/node-convert
0 ≤ 1.0.0
References
gist.github.com: https://gist.github.com/R3tro16/5a508fcfddfb0dfe66a0a53437ede74c github.com: https://github.com/enmaso/node-convert/blob/143e4d76244e2daac57eef59d8ed5983e33ee4fb/convert.js#L4-L15 github.com: https://github.com/enmaso/node-convert vulncheck.com: https://www.vulncheck.com/advisories/enmaso-node-convert-through-1.0.0-os-command-injection-via-filepath-and-convertto
Credits
William Pierson (Retro16)