External risk intelligence

WebP Converter OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110635

The vulnerability exists in a Node.js library used for image processing. While such libraries are frequently utilized in public-facing web applications to handle user-uploaded content, the library itself is a backend component rather than a standalone edge service or public-facing portal. Reachability depends entirely on how the library is implemented within a specific application's image processing pipeline.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in a web image conversion tool that could allow attackers to run unauthorized commands on systems using the affected software. The issue arises from how the tool handles filenames and options when processing webp images, potentially enabling command injection if not properly secured. The main concern is confirming whether this specific tool is in use and, if so, assessing the potential exposure.

Unchecked inputs allow attackers to run commands.
Confirms if this image tool is in use.
Assess usage and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted file names or option strings to the webp-converter's image processing functions. Because the library uses a shell to execute commands, these crafted inputs can be interpreted as operating system commands, allowing the attacker to run arbitrary code on the server hosting the application.

No authentication required.
Malicious file names or options.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary operating system commands on a server running affected software. This may occur when an attacker can control file names or option strings passed to image conversion functions, potentially leading to unauthorized command execution as the Node.js process.

Server-side OS commands at risk.
Attacker controls input to conversion functions.
Unauthorized OS command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OS command injection vulnerability in webp-converter, affecting Node.js processes that execute libwebp binaries, likely impacts application or platform teams responsible for the image processing pipeline. The first practical step is to identify all instances of this library, determine their reachability and criticality, confirm accountable owners, and then prioritize remediation based on risk.

Identify accountable application/platform owners.
Verify all webp-converter instances and exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is webp-converter?

webp-converter is a Node.js library designed to simplify image format conversions. Developers integrate it into applications to handle tasks like encoding or decoding WebP images by interfacing with underlying libwebp binaries.

How does CVE-2026-110635 enable command injection?

The vulnerability belongs to the CWE-78 weakness class, or OS Command Injection. It occurs because the library uses a function that invokes the operating system shell to execute commands. When it handles user-provided file names or configuration strings insecurely, an attacker can insert shell metacharacters to break out of the intended command and run their own unauthorized instructions.

Can any input trigger this vulnerability?

No. The flaw specifically requires an attacker to successfully inject malicious content into the file names or option strings processed by the library. If the application handles these inputs using strict validation, hardcoded configurations, or internal-only parameters that cannot be influenced by external users, the conditions for triggering the command injection are not met.

Do I need to worry if my application uses this library?

Halo Surface Signal indicates that while this is a backend library, it is often used in web applications that handle user-uploaded content. Its relevance to you depends on whether your implementation allows untrusted input to reach the image conversion functions. If your application processes files directly from the public internet using this library, the risk of external exploitation is significantly higher.

How should I respond to this threat?

Your first step is to perform an inventory of your software to identify every instance where webp-converter is utilized. Once identified, work with your application team to determine if user-controlled data reaches the conversion functions. If vulnerable workflows are found, coordinate with the appropriate owners to update the library to version 3.0.0 or later to remove the insecure shell execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.