webp-converter before version 3.0.0 contains an OS command injection flaw derived from the library’s internal use of execFile with the shell option enabled. The vulnerability is triggered when an attacker supplies crafted file names or option strings to the cwebp, dwebp, gwebp, or webpmux functions. By inserting shell metacharacters into these inputs, the attacker can force the Node.js process to execute arbitrary operating‑system commands, potentially compromising the host system. The weakness corresponds to the Common Weakness Enumeration 78 (OS Command Injection).

The affected product is the JavaScript package scionoftech/webp-converter for all releases prior to 3.0.0. Users installing or requiring older versions of this npm package may be exposed, regardless of the environment in which it runs.

The CVSS score of 9.3 indicates a critical severity level. The EPSS score of 3% indicates a moderate likelihood of exploitation. Although not listed in the KEV catalog, the exploit path is straightforward: an attacker who can influence the file name or conversion options can inject shell commands and run them with the privileges of the Node.js process. The vulnerability requires no special environmental configuration beyond ordinary use of the library, making it broadly exploitable in any deployment that allows untrusted input for conversion functions.