Vulnerability details

CVE-2026-110644

ChetanXpro nodejs-whisper

nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

CVSS 4.0

9.3Critical

Official description

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
ChetanXpro	nodejs-whisper	v ≤ 0.3.1	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/ChetanXpro/nodejs-whisper/pull/259 patchissue-tracking
https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59 technical-description
https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77 technical-description
https://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-14
Last updated: 2026-10-14
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 35 · Medium

Exploit prediction (EPSS)

2.72%

Probability of exploitation in 30 days

86%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')