Enmaso Node Convert
Monthly
OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.
OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.