Key points
- CVE-2026-107699 is rated 9.3 Critical severity on the CVSS scale.
- The vulnerability affects versions of the ppt2png npm package up to and including 0.0.6.
- Attackers exploit the flaw by injecting shell metacharacters into input or output path arguments.
Small businesses relying on Node.js applications that use the ppt2png library to convert PowerPoint files to images face a critical security risk. A newly disclosed vulnerability allows attackers to execute arbitrary commands on the host system. This issue stems from how the package handles file paths, creating a direct pathway for remote code execution.
In plain English
The ppt2png package helps developers turn PowerPoint presentations into PNG images. The problem occurs because the software does not properly check the file names or paths provided by users. When a user supplies a file name, the package passes this information to the operating system to perform the conversion.
Attackers can trick the system by adding special characters, such as a semicolon, to the end of a file name. In computer systems, a semicolon tells the operating system to stop one command and start another. By inserting this character, an attacker can hide a malicious command behind a legitimate-looking file name. The system then executes the attacker’s command instead of, or in addition to, the intended file conversion.
The background
The vulnerability is identified as CVE-2026-107699. The National Vulnerability Database rates it with a CVSS score of 9.3, which falls into the Critical category. It is classified under CWE-78, which relates to OS command injection. The flaw exists in the ppt2png.js file, specifically within the child_process.exec() function. This function is designed to run external commands, but it lacks proper sanitization of the input data.
The issue affects all versions of the tzwm ppt2png npm package up to 0.0.6. Because the commands run with the privileges of the Node.js process, an attacker who successfully exploits this flaw gains significant control over the server or machine running the application.
What changes now
Users of the affected package must immediately audit their applications. Any service that accepts file uploads or user-defined paths for conversion is potentially vulnerable. Since no patch has been confirmed in the available source material, organizations cannot simply update to a fixed version. Instead, they must remove the vulnerable package or implement strict input validation to block shell metacharacters before they reach the conversion logic.
What to do and how to stay safe: ppt2png
- Audit your Node.js dependencies to check if you are using ppt2png version 0.0.6 or earlier.
- Implement strict input validation on all file path arguments to reject special characters like semicolons or pipes.
- Review server logs for unusual command executions that may indicate exploitation of this vulnerability.
- Isolate processes running this package from sensitive system resources to limit potential damage once the vendor provides an update.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107699?
The vulnerability has a CVSS score of 9.3, which is rated as Critical severity.
Which versions of ppt2png are affected?
The flaw affects the ppt2png npm package through version 0.0.6.
How do attackers exploit this vulnerability?
Attackers append shell metacharacters, such as ';', to file names passed to the package, allowing them to run operating system commands.
