OS Command Injection Vulnerability in ppt2png by tzwm
CVE-2026-107699

9.3CRITICAL

Key Information:

Vendor

Tzwm

Status
Ppt2png
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107699?

The ppt2png version 0.0.6 is susceptible to an OS command injection vulnerability that permits malicious actors to execute arbitrary operating system commands. This vulnerability arises from the improper sanitization of input or output path arguments, enabling attackers to manipulate file names passed to the child_process.exec() method within ppt2png.js. By injecting shell metacharacters, such as ';', attackers can run commands with the privileges of the Node.js process, potentially compromising the security of affected systems.

Affected Version(s)

ppt2png 0 <= 0.0.6

References

https://gist.github.com/R3tro16/2daadc08b282c48d41203d112...
third-party-advisory
https://github.com/tzwm/ppt2png/blob/8c68eba7af943de27422...
technical-description
https://github.com/tzwm/ppt2png
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

William Pierson (Retro16)
.