Description
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| scionoftech | webp-converter | < 3.0.0 | 3.0.0 |
References
- https://github.com/scionoftech/webp-converter/pull/53 issue-tracking patch
- https://github.com/scionoftech/webp-converter/pull/53#issuecomment-5091652605 vendor-advisory patch issue-tracking
- https://github.com/scionoftech/webp-converter/commit/f1b6724bc2e89f67ab05d51a854b4b1c5a99928a patch
- https://github.com/scionoftech/webp-converter/blob/e09d963d772cae9ff6af63c268ca838ab334f861/CHANGELOG.md release-notes
- https://github.com/scionoftech/webp-converter/blob/3729b65f1e904ab56b947ac3772020ce37a756c8/src/webpconverter.js#L41-L52 technical-description
- https://github.com/scionoftech/webp-converter product
- VulnCheck Advisory: webp-converter before 3.0.0 OS Command Injection via File Names and Options third-party-advisory