CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110642

The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function. The root cause is the interpolation of unescaped file names into os.system. An attacker can execute arbitrary commands as the invoking user by providing an input file nam...

CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

EUVD-2026-101270

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110639

The @mborne/extract library (versions prior to 0.2.1 ) is vulnerable to OS command injection via the archivePath and targetDir options. The root cause is the use of unquoted shelljs exec() strings within the unzip, 7z, tar-bz2, and gz extractors. An attacker who can control these input values can...

EUVD-2026-101267

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110637 buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

EUVD-2026-101265

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

CVE-2026-110637

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

CVE-2026-110637

The buildebooks software (versions before 0.2.2 ) is vulnerable to an OS command injection in the lib/kindle.js component. The root cause is the insecure use of child_process.exec when processing filenames. An attacker can execute arbitrary commands as the user running the application by crafting...

CVE-2026-110637 buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via childprocess.exec. Attackers can craft a book project with a malicious front-matter filename or project...

EUVD-2026-101263

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...

CVE-2026-110635

The webp-converter library, in versions prior to 3.0.0 , is susceptible to an OS command injection vulnerability within the src/webpconverter.js helpers. The root cause is the use of execFile with shell enabled to run libwebp binaries. Attackers who can control file names or option strings passed...

EUVD-2026-101262

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110634

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $cmd or backtick substitutions that shelljs.exec evaluates, running comman...

CVE-2026-110635

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...