node-convert EUVD-2026-95148

Exploitation requires that a consuming application pass attacker-influenced data into node-convert's filepath or convertTo arguments, which the library concatenates into an ImageMagick command executed via child_process.exec(); injecting shell metacharacters or a single quote escapes the command. The practical limiting factor is this dependency on the host application exposing those parameters to untrusted input and having ImageMagick/the vulnerable call path reachable - in deployments that pass only trusted/internally-fixed values, the flaw is not remotely triggerable. No authentication, user interaction, or non-default configuration is required at the library level itself (PR:N/UI:N), and all versions through 1.0.0 are affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) frames this as a trivially exploitable, unauthenticated remote command-execution flaw with full confidentiality, integrity and availability impact - a worst-case profile for a code-execution bug. However, this is a severity figure that assumes the consuming application forwards attacker-controlled input directly into the vulnerable filepath/convertTo parameters; node-convert is a library, so real-world exploitability depends entirely on how downstream applications wire user input into it. A proof-of-concept gist (R3tro16) is referenced, so public exploit tradecraft exists, satisfying the 'publicly available exploit code exists' signal. The flaw is NOT in CISA KEV and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - the risk is driven by exploit availability and impact, not by observed attacks. SSVC-style reading: technical impact is Total (RCE), and the injection is Automatable where input is reachable, but exploitation status is only 'PoC' not 'Active'. Net: genuinely high technical severity, but the practical priority is gated by the tiny deployment footprint of this obscure npm package - treat as high-severity-but-narrow-blast-radius rather than a widespread emergency.

An application uses @enmaso/node-convert to convert user-uploaded images and passes the user-supplied filename or target format into the library's filepath/convertTo arguments. An attacker submits a value containing shell metacharacters or a single quote (e.g. a crafted filename like x.png'; id #), which breaks out of the ImageMagick command string that node-convert builds for child_process.exec(). A public PoC gist demonstrates the injection, and because AC is low and no user interaction or authentication is required at the library boundary, the injected OS commands execute with the Node.js process privileges.