CVE-2026-110635 is an OS command injection (CWE-78) in the webp-converter Node.js package before 3.0.0, scored 9.8 critical. File names or option strings reach a shell. Upgrade to 3.0.0, which passes arguments as an array with no shell. Note that 3.0.0 has a few breaking changes.
What's affected
webp-converter before 3.0.0, per the CVE record. The project changelog for 3.0.0 lists the security fix and says 2.x built a shell command string and ran it with execFile and the shell option on.
The record names the helper functions for cwebp, dwebp, gwebp and webpmux as the affected entry points. Any application that passes a file name or option string from a user to those helpers is exposed.
How to check if you're exposed
Find out whether the package is in your tree, direct or transitive:
npm ls webp-converter
Then search your own code for calls to the converter functions and trace where the file names and options come from. A file name that comes from an upload is the case the changelog calls out. If the value is a constant or a path you generate yourself, exposure is much lower.
Check your lock file in version control for the version number, and check build images that cache old installs.
You can also run the free in-browser dependency scan or browse the Gold directory to see where a package or product shows up in your stack.
What to do now
- Upgrade
webp-converterto 3.0.0 or later, and rebuild your lock file. - Read the 3.0.0 migration notes. Promises now reject on failure instead of resolving with the error, so wrap calls in try and catch.
- Until you can upgrade, stop passing user supplied file names or options to the helpers, and generate your own safe file names for uploads.
- Run image conversion with a low privilege user in a sandbox or container, so a mistake has a small blast radius.
- Review logs and storage for unexpected files or processes started by the application.
Why it matters
A shell reads a command string and treats certain characters as syntax. If an application builds a string from untrusted values, the shell can be made to run something else. That is CWE-78. The 3.0.0 change removes the shell, so every value reaches the binary as plain data. That is the right fix, and it is cheap to apply in new code.
The commands then run with the permissions of the Node.js process, as the record says. On servers that process uploads for many users, that process often has access to secrets and storage, so the damage can reach far beyond image handling.
The record does not flag this CVE as exploited in the wild and it is not a CISA Known Exploited Vulnerability.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does 3.0.0 change the public API?
The changelog says function names and argument order are unchanged, but some behavior changed. Promises now reject on failure, so add error handling.
Am I safe if I only use fixed file names?
Exposure is much lower when no attacker controlled value reaches the helpers, but upgrading removes the risk entirely.
Sources
Last reviewed: 19 October 2026.
