compress-fonts CVE-2026-110648

Exploitation requires that compress-fonts (before 1.1.1) processes font files whose filenames are attacker-controlled, that FontForge is installed and invoked, and that a legitimate user or automated build actually runs the compression step (UI:P). The concrete trigger is a font filename containing shell metacharacters, which index.js interpolates unquoted into the fontforge -lang=ff -c ... ${file} ... string passed to execSync. Limiting factors: the vector is local (AV:L), not network - the attacker must get a maliciously named file into the processed source directory, and a user must initiate the conversion; impact is bounded by the Node.js process privileges. Default configurations are vulnerable once such a file is present.

Signals are moderate and internally consistent rather than alarming. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:H) scores 8.5 and describes local, low-complexity code execution that requires passive user interaction - a developer or build pipeline must actually run compress-fonts over attacker-influenced font files. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so there is no evidence of active or widespread exploitation; this reads as a classic unsanitized-input command injection in a small Node.js library rather than an internet-facing emergency. The vulnerability is real and well-substantiated (root-cause source line and a vendor patch converting execSync to execFileSync are both referenced), but the local attack vector plus required user interaction and the product's tiny footprint make this a lower-priority, developer/build-chain supply-risk item rather than a mass-exploitation threat. Note the vector is AV:L (local) despite the 'attackers execute shell commands' phrasing - exploitation depends on getting a maliciously named font file into a processing pipeline, so treat it as a local/supply-chain issue, not remote network RCE.

An attacker crafts a font file whose filename embeds shell metacharacters (e.g. a backtick or ';' command) and gets it into a directory that a victim's build or asset pipeline feeds to compress-fonts. When the victim runs the tool, the filename is interpolated unquoted into the FontForge command executed via child_process.execSync, and the attacker's commands run with the Node.js process privileges. No public exploit code was identified, but the root cause and fix are documented in the referenced PR/commit.