CVE-2026-110639

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110640

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110643

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio. Attackers can inject $ or backtick substitution or a closing quote into the unescaped path passed to childprocess.exec ...

CVE-2026-110644

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110641

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110634

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110635

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...

CVE-2026-110636

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...

CVE-2026-110637

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

CVE-2026-110638

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog or tag. Attackers can embed $... or backtick command substitution in the file path, which DocData.readPDF passes to a shell-based pdftotext...

CVE-2020-37282

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf or generateHtml. Attackers can embed $..., backticks, or a closing quote with shell metacharacters in the file name, which is...

CVE-2026-101215

Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-101216

Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-110650

The thumbnail Python package (versions through 1.5 ) is vulnerable to an OS command injection in the generate_thumbnail() function. The root cause is the failure to neutralize shell metacharacters in file paths, allowing an attacker to inject commands into os.system() calls when the package execu...

EUVD-2026-101278

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110649

Versions of Stills before 25.24.2 are vulnerable to an OS command injection flaw. The vulnerability occurs when the application processes crafted media file paths containing $(...) or backticks. This allows an attacker to execute arbitrary shell commands with Node.js process privileges during the...

CVE-2026-110648

The @offactory/compress-fonts library (versions before 1.1.1 ) is vulnerable to OS command injection . The root cause is the unquoted interpolation of font paths into a FontForge command executed via child_process.execSync . An attacker can supply font files with crafted names containing shell me...

EUVD-2026-101277

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...