CVE-2026-110635

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110635
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110635.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110635
Published
2026-10-14T14:17:07Z
Modified
2026-10-24T02:30:23Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
webp-converter before 3.0.0 OS Command Injection via File Names and Options
Details

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110635.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "3.0.0"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "3.0.0"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/scionoftech/webp-converter

Affected ranges

Type
GIT
Repo
https://github.com/scionoftech/webp-converter
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f1b6724bc2e89f67ab05d51a854b4b1c5a99928a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "f1b6724bc2e89f67ab05d51a854b4b1c5a99928a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110635.json"