CVE-2026-110634 & CVE-2026-110635: Critical Command Injection in npm Packages — Detection and Remediation Guide

---
title: Node.js Process Spawning Shell — Possible npm Command Injection
id: 3f8c1a72-6b24-4d9e-a517-9e2c5d8f0a31
status: experimental
description: Detects node/npm processes spawning shell interpreters, consistent with exploitation of child_process command injection vulnerabilities such as CVE-2020-37282, CVE-2026-110634, and CVE-2026-110635 in npm packages.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2020-37282
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/npm'
      - '/nodejs'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts and npm lifecycle hooks (postinstall) during deployments
  - Development workstations running tooling
level: high
---
title: Document or Image Conversion Binary Spawning Shell or Network Tool
id: 8a2e4d61-1c73-4b58-9f02-7d6a3c5e9b44
status: experimental
description: Detects conversion utilities (unoconv, soffice, cwebp, dwebp, git) spawning shells or download/execution tools, a strong indicator of command injection via packages such as office-converter (CVE-2020-37282) or webp-converter (CVE-2026-110635).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2020-37282
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/unoconv'
      - '/soffice.bin'
      - '/soffice'
      - '/cwebp'
      - '/dwebp'
      - '/git'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; conversion utilities should not spawn shells or network tools in normal operation
level: critical
---
title: Shell Metacharacters in Node.js Child Process Command Line
id: c5d7b932-4e18-4f6a-b2d4-1a9e8c3f7d56
status: experimental
description: Detects command substitution and shell metacharacter patterns in processes spawned by node, matching documented exploitation strings for CVE-2020-37282 ($(...), backticks, quote-breakout with semicolons).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2020-37282
  - https://attack.mitre.org/techniques/T1059.004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/node'
  selection_patterns:
    CommandLine|contains:
      - '$('
      - '`'
      - '; id'
      - '; cat /etc/'
      - '| sh'
      - '| bash'
      - '; curl'
      - '; wget'
  condition: selection_parent and selection_patterns
falsepositives:
  - Ad-hoc administrative shelling from application hosts
  - Health-check wrappers using shell pipelines
level: high

// Hunt: Node.js or conversion binaries spawning shells/network tools
// Relevant to CVE-2020-37282, CVE-2026-110634, CVE-2026-110635 exploitation
// Tables: DeviceProcessEvents (Defender) — adjust to Syslog/CommonSecurityLog for CEF-ingested Linux hosts
let suspiciousChildren = dynamic(["/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "cmd.exe", "powershell.exe", "python", "perl", "nc", "ncat"]);
let suspiciousParents = dynamic(["node", "nodejs", "npm", "unoconv", "soffice", "soffice.bin", "cwebp", "dwebp", "git"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (suspiciousParents)
| where FileName in~ (suspiciousChildren)
   or ProcessCommandLine has_any ("$(", "`id`", "; id", "| sh", "| bash", "; curl", "; wget", "/etc/shadow", "/etc/passwd")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessRemoteUrl
| order by TimeGenerated desc;

-- Hunt: Node.js / conversion-tool process trees showing shell or network-tool children
-- Relevant to npm command injection (CVE-2020-37282, CVE-2026-110634, CVE-2026-110635)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(\$\(|`;|;/ *(id|cat|curl|wget|bash|sh)|\| *(ba)?sh)'
   OR (Exe =~ '(?i)(sh|bash|curl|wget|nc|ncat|python|perl)$'
       AND Name =~ '(?i)(sh|bash|curl|wget|nc|python|perl)')

#!/usr/bin/env bash
# audit-node-cmd-injection.sh — Identify vulnerable npm packages and suspicious process activity
# Covers: CVE-2020-37282 (office-converter <=1.0.2), CVE-2026-110634 (git-diff <2.0.7),
#         CVE-2026-110635 (webp-converter <3.0.0)
set -euo pipefail

TARGET_DIR="${1:-/srv}"
echo "[*] Scanning ${TARGET_DIR} for vulnerable npm packages..."

# --- 1. Locate installed copies of the vulnerable packages ---
find "${TARGET_DIR}" -type d \( -name "office-converter" -o -name "git-diff" -o -name "webp-converter" \) \
  -path "*/node_modules/*" 2>/dev/null | while read -r pkgdir; do
    pkg="$(basename "$pkgdir")"
    ver="$(grep -m1 '\"version\"' "${pkgdir}/package.json" 2>/dev/null | sed -E 's/.*"version": *"([^"]+)".*/\1/')"
    echo "[FOUND] ${pkg} @ ${ver} -> ${pkgdir}"
  done

# --- 2. Check lockfiles for pinned vulnerable versions ---
echo "[*] Checking package-lock.json / yarn.lock / pnpm-lock.yaml for vulnerable ranges..."
grep -rEl '"office-converter"|"git-diff"|"webp-converter"' "${TARGET_DIR}" \
  --include='package-lock.json' --include='yarn.lock' --include='pnpm-lock.yaml' 2>/dev/null || echo "    (no lockfile matches)"

# --- 3. Run npm audit in each discovered project root ---
find "${TARGET_DIR}" -name 'package.json' -not -path '*/node_modules/*' 2>/dev/null | while read -r manifest; do
    proj="$(dirname "$manifest")"
    echo "[*] npm audit in ${proj}"
    (cd "$proj" && npm audit --audit-level=high 2>/dev/null | head -40) || true
  done

# --- 4. Live check: node or conversion tools spawning shells right now ---
echo "[*] Checking running processes for injection indicators..."
ps auxww | grep -E '(\$\(|`.*`|; *(id|curl|wget|cat /etc)|\| *(ba)?sh)' | grep -v grep || echo "    (no suspicious command lines)"

echo "[*] Done. Remediate: git-diff>=2.0.7, webp-converter>=3.0.0, REMOVE office-converter (no patch available)."