offactory vulnerabilities

Products

• @offactory/compress-fonts 1

Latest offactory CVEs

Newest publication first

1. CVE-2026-110648 @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names

   Published 2026-10-14

   High·CVSS 8.5 EPSS 1.1%

   @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.