9.3 CVSS CVE-2026-107703: Node.js @enmaso/node-convert Library Permits Arbitrary OS Command Execution

A critical security flaw has been identified in the @enmaso/node-convert library, a tool used by Node.js developers for image conversion tasks. The vulnerability, designated CVE-2026-107703, allows remote attackers to execute arbitrary operating system commands on the host server. This issue stems from insufficient input validation within the library’s core processing logic, specifically in the convert.js module.

The risk

The core of the vulnerability lies in how the library handles user-supplied input for image conversion. According to the National Vulnerability Database (NVD), the convert.js file fails to sanitize the filepath and convertTo arguments before passing them to the underlying ImageMagick command. The library utilizes Node.js’s child_process.exec() function to run these commands. Because the inputs are not properly escaped, an attacker can inject shell metacharacters or a single quote into these arguments.

This injection technique allows the attacker to break out of the intended command structure and append malicious shell commands. When the system executes the ImageMagick conversion, it simultaneously runs the injected code. The resulting commands execute with the same privileges as the Node.js process, potentially granting the attacker full control over the server environment depending on the application’s permission level.

Who is exposed

Any software project that includes the @enmaso/node-convert library as a dependency is potentially affected. The NVD record specifies that versions up to and including 1.0.0 contain this flaw. Developers who have integrated this package into their Node.js applications for handling image uploads, resizing, or format conversions are exposed to this risk. If the application allows users to influence the filename or the target format of the conversion, the attack surface is significantly increased, as these inputs map directly to the vulnerable arguments.

Cost and compliance

The NVD rates this vulnerability with a CVSS score of 9.3, classifying it as critical. The weakness is categorized under CWE-78, which pertains to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). There is no mention in the source material of a financial cost associated with this specific disclosure, nor are there specific regulatory compliance mandates cited beyond the standard security implications of a critical remote code execution flaw.

What should you do?

Security teams should immediately audit their Node.js projects for the presence of the @enmaso/node-convert package. Identify all instances where this library is used, particularly in endpoints that accept user-generated file paths or conversion parameters. Until a verified patch is available, consider restricting the functionality or implementing strict allowlists for file names and conversion formats to mitigate the risk of injection.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: CVE-2026-107703

• Scan your dependency tree using tools like npm audit or Snyk to detect if @enmaso/node-convert (version 1.0.0 or lower) is present in your project.
• Review application logs for unusual command executions or unexpected processes spawned by the Node.js worker, which may indicate exploitation attempts.
• Implement strict input validation on any user-supplied filenames or conversion parameters before they reach the library, ensuring they contain only alphanumeric characters and standard extensions.
• Monitor vendor communications and security advisories for an official patch or updated version that addresses CVE-2026-107703.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-107703?

The CVSS score is 9.3, which is rated as critical.

Which versions of @enmaso/node-convert are affected?

All versions up to and including 1.0.0 are affected by this vulnerability.

How do attackers exploit this flaw?

Attackers inject shell metacharacters or single quotes into the filepath and convertTo arguments to execute arbitrary OS commands.