{"id":"CVE-2026-110644","summary":"nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType","details":"nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.","modified":"2026-10-16T02:47:31.745981931Z","published":"2026-10-14T14:17:13.817Z","database_specific":{"cwe_ids":["CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110644.json","cna_assigner":"VulnCheck"},"references":[{"type":"WEB","url":"https://registry.npmjs.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110644.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110644"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype"},{"type":"FIX","url":"https://github.com/ChetanXpro/nodejs-whisper/pull/259"},{"type":"PACKAGE","url":"https://github.com/ChetanXpro/nodejs-whisper"},{"type":"ARTICLE","url":"https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59"},{"type":"ARTICLE","url":"https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/chetanxpro/nodejs-whisper","events":[{"introduced":"0"},{"fixed":"fb507fb6289fa33edf49e6cb8adf44e39ed1bdc0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.3.1"},{"fixed":"0.3.1"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.2.7","v0.2.9","v0.2.8","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110644.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}