{"id":"EUVD-2026-101272","enisaUuid":"30a925fa-ae06-339c-b6ed-b8b567617e63","description":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","datePublished":"Oct 14, 2026, 2:17:13 PM","dateUpdated":"Oct 14, 2026, 5:35:48 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ChetanXpro/nodejs-whisper/pull/259\nhttps://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59\nhttps://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77\nhttps://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype\n","aliases":"CVE-2026-110644\nGHSA-2f48-3555-fpx6\n","assigner":"VulnCheck","epss":2.73,"enisaIdProduct":[{"id":"e3a0ef59-aac3-332e-83c5-d0a5fe2d7ef1","product":{"name":"nodejs-whisper","vendor":{"name":"ChetanXpro"}},"product_version":"0 ≤0.3.1"}],"enisaIdVendor":[{"id":"8ce98161-4757-340a-a93c-164e76152bb3","vendor":{"name":"ChetanXpro"}}],"enisaIdVulnerability":[{"id":"d8d0822c-6e78-3c39-8298-70a79d531631","vulnerability":{"id":"GHSA-2f48-3555-fpx6","description":"nodejs-whisper allows OS command injection through crafted audio file paths","datePublished":"Oct 14, 2026, 3:32:28 PM","dateUpdated":"Oct 28, 2026, 9:06:52 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-110644\nhttps://github.com/ChetanXpro/nodejs-whisper/pull/259\nhttps://github.com/ChetanXpro/nodejs-whisper/pull/270\nhttps://github.com/ChetanXpro/nodejs-whisper/commit/957fd84da217dd8c6265418e938a77db0e2c2ae7\nhttps://github.com/ChetanXpro/nodejs-whisper/commit/d93780c9164be5f7e0b2f4094005378923659ce5\nhttps://github.com/ChetanXpro/nodejs-whisper\nhttps://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59\nhttps://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77\nhttps://github.com/ChetanXpro/nodejs-whisper/releases/tag/v0.4.0\nhttps://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype\n","enisa_id":"EUVD-2026-101272\n","aliases":"CVE-2026-110644\nGHSA-2f48-3555-fpx6\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 11:02:20 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ddc35eeb-edc2-36b0-a9be-e8fe83483d3b","vulnerability":{"id":"CVE-2026-110644","description":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","datePublished":"Oct 14, 2026, 2:17:13 PM","dateUpdated":"Oct 14, 2026, 5:35:48 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/ChetanXpro/nodejs-whisper/pull/259\nhttps://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59\nhttps://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77\nhttps://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype\n","enisa_id":"EUVD-2026-101272\n","assigner":"VulnCheck","epss":2.73,"dataProcessed":"Oct 30, 2026, 7:14:02 AM","vulnerabilityProduct":[{"id":"c73e6641-ba3a-345b-bf8e-dd42f771f951","product":{"name":"nodejs-whisper","vendor":{"name":"ChetanXpro"}},"product_version":"0 ≤0.3.1"}],"vulnerabilityVendor":[{"id":"4fd9bac9-bf6b-338d-a209-ee5ba050ebb5","vendor":{"name":"ChetanXpro"}}]}}],"enisaIdAdvisory":[]}