office-converter through 1.0.2 contains an OS command injection flaw that allows attackers to run arbitrary commands on the host system with the privileges of the Node.js process. The vulnerability arises from unsanitized fileName values in generatePdf() or generateHtml(), which are concatenated into a child_process.exec() call to unoconv. An attacker can embed shell metacharacters such as $(...), backticks, or a closing quote in the file name, causing the underlying command to be interpreted and executed by the operating system.

The affected product is vworld4u:office-converter, any deployment of this package at or below version 1.0.2. The vulnerability exists in both generatePdf() and generateHtml() methods of this library.

The CVSS score of 9.3 indicates high severity and the vulnerability qualifies as remote code execution. The EPSS score of 3% indicates that exploit attempts are occasionally observed, yet the absence of a release that addresses the issue means the risk remains high. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish its potential impact. The likely attack path is a remote attacker supplying a crafted file name to an exposed API endpoint that triggers generatePdf() or generateHtml(), leading to execution of arbitrary shell commands with the Node.js process privileges.