Update @enmaso/node-convert Now: Critical RCE Flaw Lets Attackers Run System Commands

A widely used Node.js library for handling image conversions contains a severe security flaw that allows attackers to take control of the server running the application. The vulnerability, tracked as CVE-2026-107703, exists in the @enmaso/node-convert package and affects all versions up to 1.0.0. According to the National Vulnerability Database, the issue is rated 9.3, which falls into the critical severity range.

In plain English

Imagine you have a tool that converts images from one format to another. This tool works by sending instructions to the operating system. If the tool does not carefully check the names of the files you give it, a malicious user can sneak in extra instructions. Instead of just converting an image, the system might execute a command that deletes files, installs malware, or steals data. This is known as command injection.

In this specific case, the @enmaso/node-convert library passes file paths and conversion arguments directly to ImageMagick, a common image processing software. It uses a function called `child_process.exec()` to run these commands. Because the library does not sanitize these inputs, an attacker can insert special characters, such as single quotes or shell metacharacters, into the file path. This tricks the system into running the attacker’s chosen commands with the same privileges as the Node.js process.

The background

The vulnerability is classified under CWE-78, which refers to OS command injection. This weakness occurs when software constructs operating system commands using data from external sources without proper validation. The flaw is located specifically in the `convert.js` file within the @enmaso/node-convert package.

This issue is particularly dangerous because it allows for remote code execution. If an application using this library accepts user uploads or file paths from untrusted sources, an attacker could potentially compromise the entire server. The National Vulnerability Database notes that the attacker can execute operating system commands with the privileges of the Node.js process, meaning they gain access to whatever files and resources the application can touch.

What changes now

Security teams need to identify if they are using the @enmaso/node-convert package in their applications. The vulnerability exists in version 1.0.0 and any earlier versions. Because the source material does not confirm the release of a patched version, there is no immediate fix available from the vendor. Organizations should assume that any instance of this library is vulnerable until a secure update is officially released.

What to do and how to stay safe: @enmaso/node-convert

• Audit your Node.js projects to check if @enmaso/node-convert is listed in your dependencies.
• Isolate servers running this library from sensitive networks to limit potential damage if exploited.
• Monitor server logs for unusual command executions or unexpected processes spawned by the Node.js application.
• Once the vendor provides an update, apply the patch immediately and verify that the library version is no longer vulnerable.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-107703?

It is a critical OS command injection vulnerability in the @enmaso/node-convert Node.js library that allows attackers to execute arbitrary shell commands.

Which versions of @enmaso/node-convert are affected?

All versions up to and including 1.0.0 are affected by this vulnerability.

How do attackers exploit this flaw?

Attackers inject shell metacharacters or single quotes into the filepath or convertTo arguments, which are then executed by the operating system via ImageMagick.