{"id":"CVE-2026-110643","published":"2026-10-14T15:17:17.790","lastModified":"2026-10-16T19:03:18.127","description":"transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/kky-ykk/Transcribe2texts/blob/7e82f96466fed9ccfc40f7b9e370321701b82c32/lib/index.js#L53-L55","tags":[]},{"url":"https://github.com/kky-ykk/Transcribe2texts/pull/1","tags":[]},{"url":"https://www.vulncheck.com/advisories/transcribe2texts-through-1.0.6-os-command-injection-via-transcribeaudio-audiopath","tags":[]}],"exploitRefs":[{"url":"https://github.com/kky-ykk/Transcribe2texts/blob/7e82f96466fed9ccfc40f7b9e370321701b82c32/lib/index.js#L53-L55","tags":[]},{"url":"https://github.com/kky-ykk/Transcribe2texts/pull/1","tags":[]}],"hasPoc":true,"ai":{"summary":"The transcribe2texts library has a critical OS command injection vulnerability in its transcribeAudio() function that allows attackers to execute arbitrary commands with Node.js process privileges by injecting shell metacharacters into the audioPath parameter.","exploitability":"Exploitation is straightforward with no special preconditions required, as attackers can simply craft malicious audioPath values containing shell injection sequences like $() or backticks to trigger command execution.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary commands on the system running the Node.js application with the same privileges as the Node.js process, potentially leading to full system compromise.","remediation":"Upgrade to version 1.0.7 or later to fix the OS command injection vulnerability in transcribe2texts.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","nodejs","os-injection"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:49:17.983Z"}}