CVE-2026-107703 — @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and conv…
Published: 2026-10-08 · CVSS: 9.3 · CVSS 4.0
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7