{"id":"GHSA-2f48-3555-fpx6","revision":"70c01df3a631426eaf742603e8b2bf5d","records":[{"revision":"70c01df3a631426eaf742603e8b2bf5d","observedAt":"2026-10-28T21:55:29.474+00:00","statement":{"source":"osv","id":"GHSA-2f48-3555-fpx6","aliases":["CVE-2026-110644"],"title":"nodejs-whisper allows OS command injection through crafted audio file paths","description":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","state":0,"publishedAt":"2026-10-14T15:32:28+00:00","modifiedAt":"2026-10-28T21:15:04.1612254+00:00","affected":[{"ecosystem":"npm","name":"nodejs-whisper","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-110644","https://github.com/ChetanXpro/nodejs-whisper/pull/259","https://github.com/ChetanXpro/nodejs-whisper/pull/270","https://github.com/ChetanXpro/nodejs-whisper/commit/957fd84da217dd8c6265418e938a77db0e2c2ae7","https://github.com/ChetanXpro/nodejs-whisper/commit/d93780c9164be5f7e0b2f4094005378923659ce5","https://github.com/ChetanXpro/nodejs-whisper","https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59","https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77","https://github.com/ChetanXpro/nodejs-whisper/releases/tag/v0.4.0","https://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype"],"sourceUrl":"https://github.com/advisories/GHSA-2f48-3555-fpx6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2f48-3555-fpx6","identifiers":["GHSA-2f48-3555-fpx6","CVE-2026-110644"]},"retained":false,"historicalAffected":[]}],"coverage":[]}