Critical severity9.8NVD Advisory· Published Oct 14, 2026
CVE-2026-110640
CVE-2026-110640
Description
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.1.1
Patches
Vulnerability mechanics
References
5- github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.tsnvd
- github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.tsnvd
- github.com/ariym/whisper-node/pull/64nvd
- unpkg.com/[email protected]/dist/index.jsnvd
- www.vulncheck.com/advisories/whisper-node-through-1.1.1-os-command-injection-via-filepath-and-languagenvd
News mentions
0No linked articles in our index yet.