CVE-2026-110643

Summary

The transcribe2texts library has a critical OS command injection vulnerability in its transcribeAudio() function that allows attackers to execute arbitrary commands with Node.js process privileges by injecting shell metacharacters into the audioPath parameter.

Exploitability

Exploitation is straightforward with no special preconditions required, as attackers can simply craft malicious audioPath values containing shell injection sequences like $() or backticks to trigger command execution.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary commands on the system running the Node.js application with the same privileges as the Node.js process, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.7 or later to fix the OS command injection vulnerability in transcribe2texts.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.