Critical severity9.8NVD Advisory· Published Oct 14, 2026
CVE-2026-110643
CVE-2026-110643
Description
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.0.6
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.