OS Command Injection Vulnerability in @enmaso/node-convert by Enmaso
CVE-2026-107703

9.3CRITICAL

Key Information:

Vendor

Enmaso

Status
@enmaso/node-convert
Vendor
CVE Published:
8 October 2026

What is CVE-2026-107703?

The @enmaso/node-convert library, up to version 1.0.0, suffers from an OS command injection vulnerability in its convert.js module. Attackers can exploit this weakness by injecting shell metacharacters or a single quote into the unsanitized filepath and convertTo arguments, which are then executed by the Node.js process. This can lead to unauthorized execution of operating system commands, compromising system security. Implementing proper input validation and sanitization is crucial to mitigate this risk.

Affected Version(s)

@enmaso/node-convert 0 <= 1.0.0

References

https://gist.github.com/R3tro16/5a508fcfddfb0dfe66a0a5343...
third-party-advisory
https://github.com/enmaso/node-convert/blob/143e4d76244e2...
technical-description
https://github.com/enmaso/node-convert
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

William Pierson (Retro16)
.