CVE Intelligence

Enmaso @enmaso/node-convert vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Enmaso @enmaso/node-convert: 1 record(s), with affected versions and fixes.

CVE-2026-107703 Critical · 9.8 CWE-78 Oct 8, 2026
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.