@enmaso/node-convert vulnerabilities

CVEs whose affected-version data names the @enmaso/node-convert package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-107703Critical· 9.8PoC

3w ago

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters o…

▾ Abyssalenmaso · @enmaso/node-convertEPSS 1.8%via NVD