Skip to content
OpenAdvisories

Product · scionoftech

webp-converter

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-110635

    webp-converter before 3.0.0 OS Command Injection via File Names and Options

    webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux …

    scionoftech webp-converter