{"id":"CVE-2026-110640","published":"2026-10-14T15:17:17.277","lastModified":"2026-10-16T19:18:44.867","description":"Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L58","tags":[]},{"url":"https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L8","tags":[]},{"url":"https://github.com/ariym/whisper-node/pull/64","tags":[]},{"url":"https://unpkg.com/whisper-node@1.1.1/dist/index.js","tags":[]},{"url":"https://www.vulncheck.com/advisories/whisper-node-through-1.1.1-os-command-injection-via-filepath-and-language","tags":[]}],"exploitRefs":[{"url":"https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L58","tags":[]},{"url":"https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L8","tags":[]},{"url":"https://github.com/ariym/whisper-node/pull/64","tags":[]}],"hasPoc":true,"ai":{"summary":"Whisper-node allows attackers to inject OS commands through crafted input parameters, enabling arbitrary code execution with Node.js process privileges.","exploitability":"Exploitation is straightforward with no special preconditions needed, as attackers can directly inject shell metacharacters into command strings built by createCppCommand().","blast_radius":"The vulnerability could lead to full system compromise if exploited, as commands execute with the privileges of the Node.js process, potentially allowing attackers to read sensitive files, install malware, or pivot to other systems.","remediation":"Upgrade to whisper-node 1.1.2 or later to address the OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","nodejs"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:49:08.762Z"}}