{"schema":"vulnpedia.research/1","cve":"CVE-2026-110648","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/adamarcanov/compress-fonts/pull/1","tags":["patch","issue-tracking"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","url":"https://github.com/adamarcanov/compress-fonts/pull/1"},{"source":"nvd","sourceId":"CVE-2026-110648","modified":"2026-10-16T19:03:18.127","url":"https://github.com/adamarcanov/compress-fonts/pull/1"}]},{"url":"https://github.com/adamarcanov/compress-fonts/commit/12002e5866af2163cd34424baae5a53338951a5d","tags":["patch"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","url":"https://github.com/adamarcanov/compress-fonts/commit/12002e5866af2163cd34424baae5a53338951a5d"},{"source":"nvd","sourceId":"CVE-2026-110648","modified":"2026-10-16T19:03:18.127","url":"https://github.com/adamarcanov/compress-fonts/commit/12002e5866af2163cd34424baae5a53338951a5d"}]},{"url":"https://github.com/adamarcanov/compress-fonts/blob/7b07d20b3125a7bba8f933eeca21f5a09c8fb62a/index.js#L48","tags":["technical-description"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","url":"https://github.com/adamarcanov/compress-fonts/blob/7b07d20b3125a7bba8f933eeca21f5a09c8fb62a/index.js#L48"},{"source":"nvd","sourceId":"CVE-2026-110648","modified":"2026-10-16T19:03:18.127","url":"https://github.com/adamarcanov/compress-fonts/blob/7b07d20b3125a7bba8f933eeca21f5a09c8fb62a/index.js#L48"}]},{"url":"https://www.vulncheck.com/advisories/offactory-compress-fonts-before-1.1.1-os-command-injection-via-font-file-names","tags":["third-party-advisory"],"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","origins":[{"source":"mitre","sourceId":"VulnCheck","modified":"2026-10-14T14:17:16.381Z","url":"https://www.vulncheck.com/advisories/offactory-compress-fonts-before-1.1.1-os-command-injection-via-font-file-names"},{"source":"nvd","sourceId":"CVE-2026-110648","modified":"2026-10-16T19:03:18.127","url":"https://www.vulncheck.com/advisories/offactory-compress-fonts-before-1.1.1-os-command-injection-via-font-file-names"}]},{"source":"euvd","sourceId":"EUVD-2026-101276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101276","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-101276","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101276"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[]}