CVE-2026-107699: Attackers Execute System Commands in ppt2png via Path Injection

The open-source Node.js package ppt2png contains a critical security flaw that enables remote code execution. The vulnerability, tracked as CVE-2026-107699, allows attackers to run operating system commands with the privileges of the Node.js process. This occurs because the package fails to sanitize input and output path arguments before passing them to system commands.

In plain English

The ppt2png library converts PowerPoint presentations into PNG image files. Developers use it in applications that need to generate thumbnails or static images from slide decks. The security issue arises when the library handles file names or directory paths.

If a user or an attacker can control the name of the file being converted or the destination folder, they can insert special characters known as shell metacharacters. For example, adding a semicolon to a file name allows the command line to execute a second, separate instruction. Because the library uses the child_process.exec() function in its main script, ppt2png.js, these injected commands run directly on the server. This gives the attacker the same level of access as the application running the conversion tool.

The background

The vulnerability is classified under CWE-78, which covers OS command injection. The National Vulnerability Database assigns it a CVSS score of 9.3, placing it in the Critical severity range. This high score reflects the ease of exploitation and the severe impact of gaining code execution on a host system.

The flaw exists in all versions of ppt2png up to and including 0.0.6. The package is maintained by the vendor tzwm. Applications that depend on this library for document conversion are potentially exposed if they accept file paths from untrusted sources. This includes web applications that allow users to upload presentations for processing.

What changes now

Security teams need to identify if their applications rely on the affected versions of ppt2png. Any system using version 0.0.6 or earlier is vulnerable to command injection. Organizations should audit their Node.js dependencies to find instances of this package. If the package is in use, teams must verify if user-controlled data reaches the conversion function. Until a patched version is confirmed and deployed, the risk remains active for any exposed endpoints.

What to do and how to stay safe: ppt2png

• Scan your Node.js project dependencies to identify if ppt2png version 0.0.6 or earlier is installed.
• Review application code to ensure that file paths passed to conversion tools are not derived from user input without strict validation.
• Monitor server logs for unusual command execution or unexpected file access patterns that may indicate exploitation attempts.
• Once the vendor provides an update, test and deploy the patched version to resolve the vulnerability.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107699?

It is a critical OS command injection vulnerability in the ppt2png npm package that allows attackers to execute system commands.

Which versions of ppt2png are affected?

All versions up to and including 0.0.6 are affected by this vulnerability.

How severe is this vulnerability?

It has a CVSS score of 9.3, which is rated as Critical.