{"id":"CVE-2026-110644","kind":"vulnerability","aliases":["CVE-2026-110644","GHSA-2f48-3555-fpx6"],"related":[],"title":"nodejs-whisper allows OS command injection through crafted audio file paths","description":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","summary":"nodejs-whisper passes audio file paths into a shell command built with string interpolation in convertToWavType(), so a file name containing $() or a closing quote runs attacker-chosen commands. The commands run with the privileges of the Node.js process.","severity":"critical","cvss":9.8,"epss":0.02727,"exploited":false,"exploited_at":null,"products":[{"name":"nodejs-whisper","fixed":["0.4.0"],"affected":"< 0.4.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-78","nodejs","nodejs-whisper","npm","package","speech-to-text"],"not_affected_if":["fixed-file-names","no-user-input-in-paths"],"how_to_check":"- Run `npm ls nodejs-whisper` in each project to find the installed version.\n- Check whether application code passes user-supplied file names or paths into nodejs-whisper transcription calls.","fix":"- Upgrade `nodejs-whisper` to `0.4.0` or later.\n- Until upgraded, do not pass user-controlled file names to nodejs-whisper; rename uploads to server-generated names.","status":"open","published_at":"2026-10-14T15:17:17+00:00","first_seen_at":"2026-10-28T21:07:44+00:00","triaged_at":"2026-10-28T21:09:26+00:00","updated_at":"2026-10-28T21:35:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T21:09:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `nodejs-whisper` to `0.4.0` or later.\n- Until upgraded, do not pass user-controlled file names to nodejs-whisper; rename uploads to server-generated names.","reach":"internet","title":"nodejs-whisper: crafted audio file paths run OS commands on the server","impact":"high","summary":"nodejs-whisper passes audio file paths into a shell command built with string interpolation in convertToWavType(), so a file name containing $() or a closing quote runs attacker-chosen commands. The commands run with the privileges of the Node.js process.","category":"package","nicknames":[],"who_cares":["npm","nodejs","nodejs-whisper","speech-to-text"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands as the Node.js process user.","analyst_note":"","how_to_check":"- Run `npm ls nodejs-whisper` in each project to find the installed version.\n- Check whether application code passes user-supplied file names or paths into nodejs-whisper transcription calls.","needs_analyst":false,"not_affected_if":["fixed-file-names","no-user-input-in-paths"],"who_is_affected":"Applications that use nodejs-whisper to transcribe audio whose file path or file name can be influenced by an outside user, such as uploads that keep the original file name. Services that only transcribe files the team creates or controls with fixed names are much less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000609,"input_tokens":3387,"output_tokens":540,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-110644':15A,23A '-2026':14A,22A '-78':28B '0.3.1':84C '2f48':18A '3555':19A 'allow':4A,94C 'attack':67B,95C,105C 'attacker-chosen':66B 'audio':10A,43B,102C 'built':50B 'chosen':68B 'close':63B,114C 'command':6A,49B,69B,71B,88C,98C,111C,122C,129C 'contain':60B,85C,110C 'converttowavtyp':55B,92C 'craft':9A,101C 'cve':13A,21A 'cwe':27B 'exec':126C 'execut':97C,127C 'ffmpeg':121C 'file':11A,44B,58B,103C,108C 'fpx6':20A 'ghsa':17A 'ghsa-2f48':16A 'inject':7A,89C 'interpol':53B,118C 'name':59B,109C 'node.js':78B,131C 'nodej':2A,29B,31B,40B,81C 'nodejs':25A 'nodejs-whisp':1A,30B,39B,80C 'nodejs-whisper':24A 'npm':33B 'os':5A,87C,128C 'packag':34B 'pass':42B 'path':12A,45B,104C 'privileg':75B,133C 'process':79B,132C 'provid':107C 'quot':64B,115C 'run':65B,72B,123C 'shell':48B 'shellj':125C 'speech':36B 'speech-to-text':35B 'string':52B 'substitut':112C 'suppli':100C 'text':38B 'via':124C 'vulner':90C 'whisper':3A,26A,32B,41B,82C","nicknames":[],"mitigations":[],"who_affected":"Applications that use nodejs-whisper to transcribe audio whose file path or file name can be influenced by an outside user, such as uploads that keep the original file name. Services that only transcribe files the team creates or controls with fixed names are much less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-14T15:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2f48-3555-fpx6","url":"https://github.com/advisories/GHSA-2f48-3555-fpx6","severity":"critical","published_at":"2026-10-14T15:32:28+00:00","modified_at":"2026-10-28T21:06:53+00:00","first_seen_at":"2026-10-28T21:07:44+00:00","fetched_at":"2026-10-28T21:07:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-110644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110644","severity":null,"published_at":"2026-10-14T15:17:17+00:00","modified_at":"2026-10-16T19:18:44+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}