{"id":"CVE-2026-110644","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-110644","summary":"nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType","details":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","published":"2026-10-14T14:17:13.817Z","modified":"2026-10-15T02:47:31.808792861Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/ChetanXpro/nodejs-whisper/pull/259","label":"ChetanXpro/nodejs-whisper#259"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110644.json"},{"type":"PACKAGE","url":"https://github.com/ChetanXpro/nodejs-whisper"},{"type":"ARTICLE","url":"https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59"},{"type":"ARTICLE","url":"https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77"},{"type":"FIX","url":"https://github.com/ChetanXpro/nodejs-whisper/pull/259"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110644"},{"type":"WEB","url":"https://registry.npmjs.org"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-15T02:47:31.808792861Z"}}