CVE-2026-110644

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary OS commands with the privileges of the Node.js process by supplying a malicious audio file path. They only need access to any application interface that passes user-controlled filenames into the whisper conversion functions.

Root cause

The convertToWavType() function interpolates unsanitized audio file paths directly into an ffmpeg command string executed via shelljs.exec().

Affected systems

nodejs-whisper through 0.3.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade nodejs-whisper to a fixed release if available, or sanitize audio file paths before calling convertToWavType() by stripping shell metacharacters and restricting filenames to safe alphanumeric characters.

shell

$ npm ls nodejs-whisper

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110644