Summary
A critical OS command injection vulnerability in @enmaso/node-convert allows attacker-controlled filepath and convertTo values to alter an ImageMagick command executed by the Node.js process.
When these arguments are influenced by untrusted input, shell metacharacters or quoting can cause arbitrary operating system commands to run with the process's privileges.
A critical OS command injection vulnerability in @enmaso/node-convert allows attacker-controlled filepath and convertTo values to alter an ImageMagick command executed by the Node.js process.
When these arguments are influenced by untrusted input, shell metacharacters or quoting can cause arbitrary operating system commands to run with the process's privileges.
Affected context
The vulnerability occurs in the convert.js component of @enmaso/node-convert through version 1.0.0, where user-influenced filepath and convertTo arguments are incorporated into a command executed through Node.js child_process.exec().
Risk depends on whether an attacker can control or influence either argument and whether the vulnerable conversion function is reachable through an application, service, or processing workflow.
The vulnerability occurs in the convert.js component of @enmaso/node-convert through version 1.0.0, where user-influenced filepath and convertTo arguments are incorporated into a command executed through Node.js child_process.exec().
Risk depends on whether an attacker can control or influence either argument and whether the vulnerable conversion function is reachable through an application, service, or processing workflow.
Exploit preconditions
- Attack surface: The image conversion functionality exposed by the Node.js application
- Required access: The ability to supply or influence filepath or convertTo input
- Trigger point: Construction and execution of the ImageMagick command through
child_process.exec() - Why exploitation is possible: Input is incorporated into a shell command without sufficient validation, escaping, or use of an argument-safe process API
- Attack surface: The image conversion functionality exposed by the Node.js application
- Required access: The ability to supply or influence filepath or convertTo input
- Trigger point: Construction and execution of the ImageMagick command through
child_process.exec() - Why exploitation is possible: Input is incorporated into a shell command without sufficient validation, escaping, or use of an argument-safe process API
Why this happens
The underlying bug is shell command construction from untrusted input. The vulnerable code passes attacker-influenced values to child_process.exec(), which invokes a shell and interprets shell control characters rather than treating each value solely as a data argument.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection. The insecure pattern is combining untrusted strings with a shell command instead of using safe argument separation and strict input constraints.
The underlying bug is shell command construction from untrusted input. The vulnerable code passes attacker-influenced values to child_process.exec(), which invokes a shell and interprets shell control characters rather than treating each value solely as a data argument.
This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection. The insecure pattern is combining untrusted strings with a shell command instead of using safe argument separation and strict input constraints.
Potential impact
- Attackers may execute arbitrary operating system commands
- The Node.js process and its accessible data may be compromised
- Credentials, tokens, or files available to the process could be exposed
- The affected host or container could be altered or used for lateral movement
- Service availability and image-processing workflows could be disrupted
- Attackers may execute arbitrary operating system commands
- The Node.js process and its accessible data may be compromised
- Credentials, tokens, or files available to the process could be exposed
- The affected host or container could be altered or used for lateral movement
- Service availability and image-processing workflows could be disrupted
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from image-conversion workflows and reducing trust in input values.
Common defensive patterns include:
- Prefer process-spawning APIs that pass executable arguments separately rather than invoking a shell
- Apply strict allowlists for permitted conversion formats, options, and filepath representations
- Canonicalize and constrain file paths to approved directories
- Avoid accepting conversion arguments directly from untrusted callers
- Run image-processing operations with least-privilege accounts and isolated filesystem access
- Limit available operating system capabilities and protect credentials from the conversion process
Validation should remain an additional control rather than the sole defense against command injection.
Mitigation generally focuses on removing shell interpretation from image-conversion workflows and reducing trust in input values.
Common defensive patterns include:
- Prefer process-spawning APIs that pass executable arguments separately rather than invoking a shell
- Apply strict allowlists for permitted conversion formats, options, and filepath representations
- Canonicalize and constrain file paths to approved directories
- Avoid accepting conversion arguments directly from untrusted callers
- Run image-processing operations with least-privilege accounts and isolated filesystem access
- Limit available operating system capabilities and protect credentials from the conversion process
Validation should remain an additional control rather than the sole defense against command injection.
How teams detect issues like this
Organizations can look for command-injection risks through:
- Static analysis rules identifying
child_process.exec()or equivalent shell APIs fed by request, file, or message data - Code review checks for string concatenation or interpolation when constructing operating system commands
- Searches for image-conversion arguments that bypass typed, fixed argument boundaries
- Runtime monitoring of unexpected child processes, shell invocation, and unusual ImageMagick activity
- Policy enforcement that restricts shell execution from application services and build pipelines
Automated code-review and software-composition tools may help identify unsafe process-execution patterns, but findings should be validated against actual data flows.
Organizations can look for command-injection risks through:
- Static analysis rules identifying
child_process.exec()or equivalent shell APIs fed by request, file, or message data - Code review checks for string concatenation or interpolation when constructing operating system commands
- Searches for image-conversion arguments that bypass typed, fixed argument boundaries
- Runtime monitoring of unexpected child processes, shell invocation, and unusual ImageMagick activity
- Policy enforcement that restricts shell execution from application services and build pipelines
Automated code-review and software-composition tools may help identify unsafe process-execution patterns, but findings should be validated against actual data flows.
