Compress Fonts
Monthly
OS command injection in @offactory/compress-fonts before 1.1.1 lets an attacker execute arbitrary shell commands with the privileges of the Node.js process by getting a font file with shell metacharacters in its filename into a directory that is being compressed. The supplied CVSS 4.0 vector indicates no authentication is required (PR:N) and high confidentiality, integrity, and availability impact to the vulnerable component, but the attack vector is local (AV:L) and requires a user or automated build to initiate the FontForge conversion (UI:P), so real-world impact is bounded by who can place files in the processed source directory and by the privileges under which the build runs. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in version 1.1.1, which replaces execSync with execFileSync.
OS command injection in @offactory/compress-fonts before 1.1.1 lets an attacker execute arbitrary shell commands with the privileges of the Node.js process by getting a font file with shell metacharacters in its filename into a directory that is being compressed. The supplied CVSS 4.0 vector indicates no authentication is required (PR:N) and high confidentiality, integrity, and availability impact to the vulnerable component, but the attack vector is local (AV:L) and requires a user or automated build to initiate the FontForge conversion (UI:P), so real-world impact is bounded by who can place files in the processed source directory and by the privileges under which the build runs. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in version 1.1.1, which replaces execSync with execFileSync.