CVE-2026-110640

Summary

Whisper-node allows attackers to inject OS commands through crafted input parameters, enabling arbitrary code execution with Node.js process privileges.

Exploitability

Exploitation is straightforward with no special preconditions needed, as attackers can directly inject shell metacharacters into command strings built by createCppCommand().

Blast radius

The vulnerability could lead to full system compromise if exploited, as commands execute with the privileges of the Node.js process, potentially allowing attackers to read sensitive files, install malware, or pivot to other systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to whisper-node 1.1.2 or later to address the OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.