CVE-2026-107699

{
  "etk_id": "ETK-2026-1015",
  "cve_id": "CVE-2026-107699",
  "display_id": "CVE-2026-107699",
  "ghsa_id": "GHSA-hqhf-w97p-6w2f",
  "euvd_id": "EUVD-2026-95145",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in ppt2png",
  "summary": "ppt2png through version 0.0.6 is affected by OS command injection in its handling of input and output path arguments. An attacker who can supply those path values may cause commands to run with the privileges of the Node.js process.",
  "mitigation": "Prevent untrusted users from controlling input or output path arguments, and strictly allow-list or validate accepted paths before invoking ppt2png. Run the service with least-privileged permissions and isolate it from sensitive systems.",
  "vendor": "tzwm",
  "product": "ppt2png",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.0.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "ppt2png",
      "purl": "pkg:npm/ppt2png"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0147,
  "epss_percentile": 0.7351,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.597831466666667,
  "t0_at": "2026-10-08T18:36:35.066000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T18:36:35.066000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:36:35.066000+00:00",
      "url": "https://github.com/advisories/GHSA-hqhf-w97p-6w2f"
    }
  }
}