Critical OS Command Injection Flaw Found in ppt2png npm Package

A critical operating system command injection vulnerability has been identified in the ppt2png Node.js package, allowing attackers to execute arbitrary system commands. The flaw, tracked as CVE-2026-107699, affects all versions of the library up to and including 0.0.6.

The vulnerability stems from insufficient input validation within the ppt2png.js file. Specifically, the library fails to sanitize input or output path arguments before passing them to the `child_process.exec()` function. This oversight permits an attacker to append shell metacharacters, such as a semicolon, to file names. When processed, these injected characters allow the execution of operating system commands with the same privileges as the running Node.js process.

Technical Details and Severity

The National Vulnerability Database (NVD) has assigned a CVSS score of 9.3 to CVE-2026-107699, classifying the severity as Critical. The weakness is categorized under CWE-78, which refers to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

According to the NVD record, the attack vector involves supplying unsanitized input or output path arguments. Because the `child_process.exec()` function in Node.js executes commands via the shell, it is inherently susceptible to injection if user-controlled data is not properly escaped. By manipulating the file name argument, an attacker can break out of the intended command context and run their own code. This execution occurs with the privileges of the Node.js process, potentially leading to full system compromise if the service runs with elevated permissions.

Who Is Affected

The vulnerability affects software projects that depend on the `ppt2png` package, published by the vendor tzwm. The issue is present in all releases up to version 0.0.6. Organizations and developers utilizing this library to convert PowerPoint presentations to PNG images are at risk if they process files from untrusted sources or allow user input to influence file paths.

Any application integrating ppt2png that passes user-controlled data into the conversion function without additional sanitization layers is vulnerable. The impact depends on the deployment environment; however, the ability to execute OS commands represents a severe security risk in most web and server-side architectures.

What should you do?

Developers should immediately audit their dependencies to check for the presence of ppt2png versions 0.0.6 or lower. If the package is in use, teams should evaluate the risk of exposure. Since the source material does not confirm the release of a patched version, immediate mitigation strategies are required.

Until a fix is confirmed, organizations should avoid passing user-controlled input directly to the ppt2png library’s file path arguments. Implementing strict input validation and sanitization on the application level before data reaches the library can help mitigate the risk. Additionally, running the Node.js process with the least privilege necessary can limit the potential damage of a successful exploitation.