Enmaso vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Enmaso products: 1 record(s), with severity, exploitation and fixes.

@enmaso/node-convert 1

Exploited only (KEV) →

CVE-2026-107703 Critical · 9.8 CWE-78 Oct 8, 2026

@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.