Webp Converter
Monthly
OS command injection in webp-converter before 3.0.0 lets unauthenticated remote attackers execute arbitrary operating system commands as the Node.js process when a host application routes attacker-controlled file names or option strings into the library’s cwebp, dwebp, gwebp, or webpmux helper functions. The flaw carries a CVSS 4.0 score of 9.3 (with an independent CVSS 3.1 assessment of 9.8), but because webp-converter is a library rather than a listening service, real-world risk depends on whether the integrating application actually passes untrusted input into the vulnerable code path; applications that use only server-controlled, fixed paths and options are not exposed. No public exploit code has been identified at the time of analysis, and the vendor has released version 3.0.0 to fix the issue.
OS command injection in webp-converter before 3.0.0 lets unauthenticated remote attackers execute arbitrary operating system commands as the Node.js process when a host application routes attacker-controlled file names or option strings into the library’s cwebp, dwebp, gwebp, or webpmux helper functions. The flaw carries a CVSS 4.0 score of 9.3 (with an independent CVSS 3.1 assessment of 9.8), but because webp-converter is a library rather than a listening service, real-world risk depends on whether the integrating application actually passes untrusted input into the vulnerable code path; applications that use only server-controlled, fixed paths and options are not exposed. No public exploit code has been identified at the time of analysis, and the vendor has released version 3.0.0 to fix the issue.