---
id: CVE-2026-110635
title: >-
  webp-converter before 3.0.0 contains an OS command injection vulnerability in
  src/webpconverter.js helpers that run libwebp binaries via execFile with shell
  enabled
summary: >-
  webp-converter before 3.0.0 contains an OS command injection vulnerability in
  src/webpconverter.js helpers that run libwebp binaries via execFile with shell
  enabled. Attackers controlling file names or option strings passed to cwebp,
  dwe…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T15:17:16.560'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110635'
references:
  - url: 'https://github.com/scionoftech/webp-converter'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a
    label: disclosure@vulncheck.com
  - url: 'https://github.com/scionoftech/webp-converter/pull/53'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/webp-converter-before-3.0.0-os-command-injection-via-file-names-and-options
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.013Z'
---

## Overview

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.