CVE-2026-110644

Summary

The vulnerability allows attackers to inject OS commands through crafted audio file paths in the nodejs-whisper library, potentially executing arbitrary code with Node.js process privileges. This is critical because it enables remote command execution on systems processing audio files.

Exploitability

Exploitation is straightforward requiring only a specially crafted audio filename with shell command injection syntax like $() or quotes, with no authentication required for the vulnerable function.

Blast radius

The impact could be severe across all systems using nodejs-whisper 0.3.1 or earlier that process user-uploaded audio files, potentially leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to nodejs-whisper version 0.3.2 or later to address the OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.