OS Command Injection in transcribe2texts

The transcribe2texts package, specifically versions 1.0.6 and earlier, contains a critical OS command injection vulnerability. The vulnerability resides in the transcribeAudio function, which fails to properly sanitize the audioPath input before passing it to the child_process.exec() function. An attacker can supply a crafted audioPath string containing shell metacharacters such as $() or backticks, effectively breaking out of the intended path string to execute arbitrary OS commands. The commands are executed with the privileges of the Node.js process running the library, which could lead to full system compromise depending on the execution context. This flaw is classified as critical, with a CVSS v3.1 base score of 9.8, necessitating an immediate update for any application utilizing this library to handle user-supplied audio paths.

Impact

Successful exploitation allows for arbitrary code execution on the server hosting the Node.js application. This could result in unauthorized data access, exfiltration of sensitive information, or complete system takeover. The scope of impact is broad, affecting any software product that integrates this library and exposes the vulnerable transcribeAudio function to untrusted input.

Recommendation

• Immediately upgrade the transcribe2texts dependency to a patched version beyond 1.0.6 if available.
• Audit applications utilizing transcribe2texts to identify instances where user-supplied input is passed to the transcribeAudio function.
• Implement strict input validation or sanitization for all file path parameters before passing them to backend functions.
• Apply the principle of least privilege by ensuring the Node.js process runs under a service account with restricted filesystem and network access to contain potential exploitation.