Key points
- CVE-2026-107699 is rated Critical with a CVSS score of 9.3.
- Attackers exploit the vulnerability by appending shell metacharacters like semicolons to file paths.
- The flaw exists in versions of ppt2png through 0.0.6 maintained by vendor tzwm.
The Node.js package ppt2png contains a severe security flaw that allows attackers to execute arbitrary operating system commands. This vulnerability, tracked as CVE-2026-107699, affects all versions of the software up to and including 0.0.6.
The issue stems from improper input validation within the package’s core functionality. According to the National Vulnerability Database, the vulnerability is classified under CWE-78, which denotes improper neutralization of special elements used in an OS command. The flaw allows an attacker to inject malicious code by supplying unsanitized input or output path arguments. Specifically, the vulnerability resides in the `ppt2png.js` file, where user-controlled data is passed directly to the `child_process.exec()` function without adequate sanitization.
Technical Mechanics
The exploitation of this flaw relies on the ability to append shell metacharacters to filenames. An attacker can craft a filename that includes characters such as the semicolon (`;`), which acts as a command separator in many shell environments. When the `ppt2png.js` script processes these filenames, it passes them to `child_process.exec()`.
Because the input is not sanitized, the shell interprets the appended metacharacters and subsequent commands as valid instructions. This allows the attacker to execute operating system commands with the same privileges as the Node.js process running the application. The severity of this issue is rated as Critical, with a CVSS score of 9.3, reflecting the high likelihood of successful exploitation and the significant impact on system integrity and confidentiality.
Affected Components
This vulnerability specifically impacts the `ppt2png` npm package, which is developed and maintained by the vendor tzwm. The flaw is present in all versions of the package up to 0.0.6. System administrators and developers who have integrated this package into their Node.js applications for converting PowerPoint presentations to PNG images are at risk. Any application that accepts user-controlled input for file names or paths and passes them to this package is potentially vulnerable to remote code execution. The scope of the impact depends on the privileges of the Node.js process hosting the application, but the ability to execute arbitrary OS commands represents a severe security compromise.
Next steps
There is no confirmed fix or patched version of the ppt2png package available in the source material. System administrators should immediately audit their Node.js environments for the presence of the `ppt2png` package. If the package is installed, administrators should verify the version number. Any instance of version 0.0.6 or earlier should be considered vulnerable. Until a secure update is released by the vendor, organizations should consider removing the package or implementing strict input validation at the application layer to prevent the passage of shell metacharacters. Monitoring for any official announcements from tzwm regarding a remediation is essential.
What to do and how to stay safe: CVE-2026-107699
- Verify patch signatures before installation to prevent supply chain attacks.
- Test patches in an isolated environment that mirrors production dependencies.
- Maintain a documented rollback procedure for every emergency deployment.
Emergency patching requires verification, testing, and controlled rollout to avoid introducing new failures. Always maintain a tested rollback plan before applying any critical update.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107699?
The CVSS score for CVE-2026-107699 is 9.3, which is rated as Critical.
Which versions of ppt2png are affected by this vulnerability?
All versions of the ppt2png package up to and including 0.0.6 are affected.
How does an attacker exploit this OS command injection flaw?
Attackers exploit the flaw by appending shell metacharacters, such as semicolons, to file names passed to the child_process.exec() function.
