Is CVE-2026-107703 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107703?

CVE-2026-107703 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-107703

Description

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.