The vulnerability is an OS command injection (CWE‑78) that occurs when font file names containing shell metacharacters are passed unquoted into a FontForge command executed by child_process.execSync. This allows an attacker to run arbitrary shell commands with the privileges of the Node.js process, leading to full compromise of confidentiality, integrity, and availability.

The affected product is compress‑fonts maintained by adamarcanov. Any release before version 1.1.1 is vulnerable; deployments that use these older releases and that process user‑supplied font files without sanitizing names are at risk.

Based on the description, the likely attack vector is a scenario in which an attacker can provide a crafted font file name to the application—for example, by uploading a font during an asset upload workflow or by embedding a malicious font in a build pipeline. When the application invokes FontForge through child_process.execSync, the unescaped file path causes the shell to interpret the embedded metacharacters, allowing the attacker’s commands to execute. The CVSS score of 8.5 indicates high severity, the EPSS score of 1% reflects a low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalogue.