What’s Vulnerable › Vulnerabilities

CVE-2026-107699: ppt2png through 0.0.6 OS Command Injection via input and output paths

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-14
• Weakness: CWE-78

Description

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.

Affected products

• tzwm ppt2png: through 0.0.6

References

• https://gist.github.com/R3tro16/2daadc08b282c48d41203d1125d7632a
• https://github.com/tzwm/ppt2png
• https://github.com/tzwm/ppt2png/blob/8c68eba7af943de27422b12c6e224d28587af7ae/ppt2png.js#L5-L35
• https://www.vulncheck.com/advisories/ppt2png-through-0.0.6-os-command-injection-via-input-and-output-paths

Get alerted when CVE-2026-107699 or the next vulnerability affects your stack