Critical OS Command Injection Flaw Found in Node.js Image Conversion Library

A critical operating system command injection vulnerability has been identified in the @enmaso/node-convert npm package, affecting versions up to and including 1.0.0. The flaw, tracked as CVE-2026-107703, allows attackers to execute arbitrary shell commands on the host system by manipulating specific input arguments.

The vulnerability stems from insufficient sanitization of the `filepath` and `convertTo` arguments within the library’s core `convert.js` module. According to the National Vulnerability Database (NVD) record, the issue is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The NVD assigns the vulnerability a CVSS score of 9.3, categorizing it as Critical. This high severity rating reflects the potential for complete system compromise if an attacker successfully exploits the flaw.

Technical Details of the Exploit

The root cause of the vulnerability lies in how the library handles user-supplied input when invoking external processes. The `convert.js` file utilizes the `child_process.exec()` function to run ImageMagick commands for image conversion tasks. Because the `filepath` and `convertTo` arguments are not properly sanitized before being passed to this function, an attacker can inject malicious input.

Specifically, an attacker can insert shell metacharacters or a single quote into these arguments. This injection breaks out of the intended command structure, allowing the attacker to append and execute additional operating system commands. These commands are executed with the same privileges as the Node.js process running the application. Consequently, if the Node.js application runs with elevated privileges or access to sensitive data, the impact of the exploit can be severe, potentially leading to full system takeover, data exfiltration, or further lateral movement within a network.

Who Is Affected

The vulnerability affects any application that depends on the `@enmaso/node-convert` package. The NVD record specifies that all versions through 1.0.0 are vulnerable. This includes version 1.0.0 itself. Developers who have integrated this library into their Node.js projects to handle image conversion tasks using ImageMagick are exposed to this risk.

Because the package is available on npm, it may be included directly as a dependency or indirectly as a transitive dependency in other projects. Any Node.js application that accepts user-controlled input for image file paths or conversion parameters and passes them to this library is potentially vulnerable to remote code execution.

What should you do?

The source material does not indicate that a patched version of the `@enmaso/node-convert` package has been released. As of the latest available information, no fix has been confirmed. Security professionals and developers should assume that versions up to 1.0.0 remain vulnerable.

Organizations should audit their Node.js dependencies to identify if `@enmaso/node-convert` is present in their supply chain. If the package is in use, immediate mitigation strategies should be considered, such as isolating the affected application, restricting network access, or removing the dependency until a secure update is available. Input validation at the application level, ensuring that `filepath` and `convertTo` arguments contain only expected characters, may provide temporary protection, though removing the vulnerable component is the most effective remedy.