CVE-2026-110648
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows…
- Risk score
- 60/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 1.1%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execu…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.1.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 7.8 high
References
- https://github.com/adamarcanov/compress-fonts/blob/7b07d20b3125a7bba8f933eeca21f5a09c8fb62a/index.js#L48
- https://github.com/adamarcanov/compress-fonts/commit/12002e5866af2163cd34424baae5a53338951a5d
- https://github.com/adamarcanov/compress-fonts/pull/1
- https://www.vulncheck.com/advisories/offactory-compress-fonts-before-1.1.1-os-command-injection-via-font-file-names
Original description
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
Last activity 14 Oct 2026. Patch Forecast updates every hour.