@enmaso/node-convert 1.0.0 users face CVE-2026-107703 critical RCE from unsanitized inputs

A critical operating system command injection flaw has been identified in the popular Node.js image conversion library @enmaso/node-convert. The vulnerability, tracked as CVE-2026-107703, allows attackers to execute arbitrary shell commands on affected servers by manipulating input arguments.

What happened

The National Vulnerability Database records CVE-2026-107703 as a critical severity issue with a CVSS score of 9.3. This rating reflects the high impact of remote code execution capabilities available to attackers who can manipulate the library’s inputs. The flaw exists specifically within the convert.js file of the @enmaso/node-convert package.

The vulnerability affects all versions of the library through 1.0.0, as stated in the NVD record. The underlying weakness is classified as CWE-78, which refers to improper neutralization of special elements used in an OS command. This classification highlights the failure to sanitize user-supplied data before passing it to system-level functions.

Attackers exploit this issue by injecting shell metacharacters or single quotes into specific arguments. The library passes these unsanitized inputs directly to the ImageMagick command via the Node.js child_process.exec() function. This execution method runs the commands with the same privileges as the Node.js process itself.

The affected arguments are the filepath and convertTo parameters used during image conversion tasks. By crafting malicious values for these fields, an attacker can break out of the intended command structure. This allows them to append and execute their own operating system commands on the host machine.

Why it matters

Security operations teams must treat this vulnerability as an urgent risk due to its critical CVSS score. Any Node.js application using @enmaso/node-convert version 1.0.0 or earlier is potentially exposed to remote code execution. The impact depends on the privileges of the Node.js process running the affected application.

If the Node.js process runs with elevated privileges, the compromise could lead to full server takeover. Attackers could install malware, create backdoors, or pivot to other internal systems. The ease of exploitation via standard image conversion workflows makes this a high-priority target for threat actors.

The use of ImageMagick within the library adds complexity to the attack surface. ImageMagick is a powerful but complex tool that has historically been associated with various vulnerabilities. Combining its execution with unsanitized Node.js inputs creates a significant security gap.

Organizations relying on automated image processing pipelines are particularly at risk. These systems often handle untrusted user uploads, providing a direct path for exploitation. Without proper input validation at the application layer, the library’s flaw remains exploitable.

Our take on the response

• Identify all instances of @enmaso/node-convert in your Node.js dependency trees immediately.
• Verify that no version 1.0.0 or earlier is present in production or staging environments.
• Monitor server logs for unusual shell command executions or unexpected process spawns.
• Review input validation logic for any components that handle file paths or conversion formats.

Background: Input validation

Input validation is the process of verifying that data entering a system matches expected formats, types, and ranges before processing. It prevents malicious payloads from executing code or crashing services. You must validate at every entry point, not just the user interface, because attackers bypass front-end checks entirely.

Read the full guide: What Is Input Validation: How to Stop Bad Data From Breaking Systems

What to do and how to stay safe: CVE-2026-107703

• Audit your Node.js project dependencies to identify any use of the @enmaso/node-convert package.
• Implement strict input validation for all user-supplied file paths and conversion parameters.
• Restrict the privileges of the Node.js process to limit the impact of potential command execution.
• Monitor system logs for anomalous command execution patterns that may indicate exploitation attempts.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-107703?

The National Vulnerability Database rates CVE-2026-107703 with a CVSS score of 9.3, which is classified as Critical.

Which versions of @enmaso/node-convert are affected?

All versions of the @enmaso/node-convert library up to and including version 1.0.0 are affected by this vulnerability.

How do attackers exploit this vulnerability?

Attackers inject shell metacharacters or single quotes into the filepath and convertTo arguments to execute arbitrary OS commands.