9.3 CVSS Score: ppt2png npm Package Flaw Enables Remote Code Execution

A severe security flaw in the ppt2png Node.js package allows remote attackers to execute arbitrary operating system commands. The vulnerability, tracked as CVE-2026-107699, has been assigned a CVSS score of 9.3 by the National Vulnerability Database, placing it in the Critical severity range. The issue stems from improper input validation in how the package handles file paths, creating a direct vector for OS command injection.

The risk

The core of the vulnerability lies in the use of the `child_process.exec()` function within the package’s main script, `ppt2png.js`. According to the NVD record, the package fails to sanitize input or output path arguments provided by users or automated systems. An attacker can exploit this by appending shell metacharacters, such as a semicolon, to file names.

When the package processes these manipulated paths, it executes the injected commands with the same privileges as the Node.js process running the application. This effectively grants an attacker the ability to run system-level commands on the host machine, potentially leading to full system compromise, data theft, or the installation of further malware.

Who is exposed

The vulnerability affects all versions of the ppt2png package published by vendor tzwm up to version 0.0.6. Any organization or development team that has included this specific npm package in their Node.js projects is potentially exposed. This includes applications that rely on ppt2png for converting PowerPoint presentations to PNG images, particularly if these applications process files or paths provided by external users or untrusted sources. Developers who have pinned their dependencies to versions 0.0.6 or lower in their `package.json` files are directly at risk until they migrate to a patched version or remove the dependency.

Cost and compliance

The source material does not provide specific data regarding financial costs, regulatory penalties, or compliance impacts associated with this vulnerability. However, the critical nature of the flaw and its potential for remote code execution could have significant implications for organizations subject to strict security standards.

What should you do?

Organizations should immediately audit their Node.js projects to identify any usage of the ppt2png package. If the package is present in versions through 0.0.6, teams should prioritize removing the dependency or replacing it with a secure alternative, as no patch has been confirmed in the provided materials.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: ppt2png

• Scan your project dependencies for the ppt2png package and check the installed version against the affected range (through 0.0.6).
• Review application logs for any unusual command execution or unexpected process activity that might indicate exploitation of the child_process.exec() function.
• Implement strict input validation for any file paths or names passed to conversion tools, ensuring shell metacharacters are rejected or escaped.
• Monitor vendor announcements and security advisories for updates regarding CVE-2026-107699, and apply fixes once the vendor provides an official update.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-107699?

The CVSS score for CVE-2026-107699 is 9.3, which is rated as Critical.

Which versions of ppt2png are affected by this vulnerability?

All versions of the ppt2png package through 0.0.6 are affected.

How does the vulnerability allow command execution?

Attackers can append shell metacharacters like ';' to unsanitized input or output path arguments, which are then passed to child_process.exec().