Vulnerabilidades de Enmaso
CVEs publicadas que afetam produtos de Enmaso: 1 registro(s), com severidade, exploração e correções.
CVE-2026-107703
Crítica · 9.8
CWE-78 08/10/2026
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.