CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-107699 — ppt2png through 0.0.6 contains an OS command injection vulnerability that allows...

·Source: NIST NVD

Updated:

Executive Summary

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.

Analysis

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges. CVSS Score: 9.8. Published: 2026-10-08T19:17:01.853.

Indicators of Compromise (1)

CVE (1)
CVE-2026-107699
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Standard Chartered to acquire Zodia Custody

UK bank and global custodian Standard Chartered is set to acquire digital assets service provider Zodia Custody.

Finextra
CRITICALVulnerabilityNEWPOC

Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)

PHP.net announced that it will release a critical update today. We decided to change the infoCon to YELLOW due to the widespread use of PHP, the expected severity of the flaw (CVSS 9.4), and the availability of early PoC exploits ahead of the patch becoming available. 

CVE-2026-109618CVE-2026-109619
SANS ISC
MEDIUMVulnerability

Microsoft PowerToys adds CursorHide, Button Lock mouse tools

Microsoft has released PowerToys 0.102, with two new mouse utilities, new command-line tools, and Command Palette improvements. [...]

BleepingComputer