CVE-2026-110640

EUVD-2026-101268
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L58
https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L8
https://github.com/ariym/whisper-node/pull/64
https://unpkg.com/whisper-node@1.1.1/dist/index.js
https://www.vulncheck.com/advisories/whisper-node-through-1.1.1-os-command-injection-via-filepath-and-language