Vulnerabilities
9.3 CVSS Score: ppt2png npm Package Flaw Enables Remote Code Execution
A critical OS command injection flaw in ppt2png versions through 0.0.6 allows attackers to execute system commands via unsanitized path inputs.
OS command injection
Everything Vector Tribune has reported about OS command injection: 3 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
9.3 CVSS CVE-2026-107703: Node.js @enmaso/node-convert Library Permits Arbitrary OS Command Execution
A critical flaw in the @enmaso/node-convert Node.js library allows attackers to execute arbitrary operating system commands via unsanitized image conversion arguments.
Vulnerabilities
Ruby image_optimizer gem vulnerable to RCE via shell metacharacters in versions 1.3.0-1.9.0
The image_optimizer Ruby gem allows remote code execution via crafted file paths when the identify option is enabled, posing a critical risk to applications.