Live › vulnerability › CVE-2026-110644
Go to dashboardnodejs-whisper passes audio file paths into a shell command built with string interpolation in convertToWavType(), so a file name containing $() or a closing quote runs attacker-chosen commands. The commands run with the privileges of the Node.js process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 21:07 UTC, 0h before NVD. All times on this page are UTC.
Applications that use nodejs-whisper to transcribe audio whose file path or file name can be influenced by an outside user, such as uploads that keep the original file name. Services that only transcribe files the team creates or controls with fixed names are much less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| nodejs-whisper | npm | < 0.4.0 | 0.4.0 |
npm ls nodejs-whisper in each project to find the installed version.nodejs-whisper to 0.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-110644")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.