Description

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:16.560Z",
  "pubdate": "2026-10-14T15:17:16.560Z",
  "executiveSummary": "The webp-converter package, specifically versions prior to 3.0.0, is susceptible to an OS command injection vulnerability located within its internal helper functions. This security flaw stems from the insecure handling of user-supplied input when invoking external libwebp binaries.\nBy manipulating parameters such as filenames or option strings passed to the cwebp, dwebp, gwebp, or webpmux functions, an unauthenticated attacker can inject arbitrary shell metacharacters. Successful exploitation enables the execution of unauthorized operating system commands with the same privileges as the underlying Node.js process.\nThe risk implication is critical, as this vulnerability permits remote code execution, potentially leading to a complete compromise of the host environment. This flaw highlights a failure in input sanitization when interacting with system-level subprocesses, posing a significant threat to any application utilizing these libraries to process externally provided or untrusted image data.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the subprocess invocation logic within src/webpconverter.js. The library utilizes the Node.js execFile function to execute libwebp binary tools; however, the configuration of these calls inadvertently enables shell execution capabilities. When execFile is invoked with shell-enabled parameters, the operating system interprets metacharacters within the command string.\nThe attack flow initiates when an application using webp-converter processes a malicious input intended for one of the library's primary functions: cwebp, dwebp, gwebp, or webpmux. An attacker provides a craftily prepared string—such as a filename containing shell injection sequences (e.g., ';', '&&', or '||')—as an argument. Because the library fails to adequately sanitize these inputs or isolate them from the command shell execution context, the shell interprets these injected sequences as legitimate command delimiters.\nUpon execution, the Node.js process spawns a subshell that interprets the attacker's payload alongside the legitimate binary call. This permits the attacker to chain arbitrary system commands following the intended utility execution. Since the Node.js process typically operates with the permissions of the application user, the injected commands inherit these privileges, facilitating unauthorized file system access, data exfiltration, or the establishment of persistent backdoors within the server environment.\nThis vulnerability does not require authentication, as the attack vector is exposed through the standard library interface. The exposure is largely dependent on the application's design; if the application accepts filenames or processing options from end-users or external sources (e.g., user-uploaded image processing pipelines), it becomes immediately susceptible. The lack of validation on the arguments passed to execFile creates a direct pathway for command execution. Post-exploitation, the impact is comprehensive, ranging from unauthorized modification of system files and configuration changes to the potential lateral movement within the network infrastructure, as the adversary gains full control over the execution context of the Node.js process."
}