9.8

CVE-2026-110635

CVSS: 9.8v3.1CriticalReceived
Published 2026-10-14Last modified 2026-10-14
Open JSON

Vulnerability summary

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (cve.org)
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listed0 of 3 catalogs
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 2026-10-14
    PublishedVulnerability first disclosed.

Description

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.

CVSS metrics

4 scores · 2 sources · 2 versions

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Scionoftech1 product
  • webp-converter< 3.0.0

1 vendor · 1 product

References

7 links