CVE-2026-110635

Summary

This vulnerability allows attackers to inject OS commands through webp conversion functions that use shell execution, potentially leading to full system compromise when processing malicious files or options.

Exploitability

Exploitation is straightforward for attackers who can control file names or option strings passed to webp conversion functions, requiring no special privileges beyond the ability to trigger the conversion process.

Blast radius

The impact could be severe across all systems running vulnerable versions of webp-converter, especially those processing user-uploaded files or allowing external input in conversion parameters.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.0 or later to fix the OS command injection vulnerability in src/webpconverter.js helpers.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.