compress-fonts vulnerabilities

CVEs whose affected-version data names the compress-fonts package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110648High· 7.8

2w ago

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge comma…

▾ Twilightadamarcanov · compress-fontsEPSS 1.1%via NVD