OS Command Injection in nodejs-whisper

The nodejs-whisper library, specifically versions 0.3.1 and earlier, contains a critical OS command injection vulnerability within the convertToWavType() function. This vulnerability arises because the package uses the shelljs exec() function to invoke the ffmpeg utility to process audio files. The library fails to sanitize user-supplied file paths, allowing an attacker to inject shell metacharacters such as command substitution ($()) or closing quotes into the command string. When an application utilizing nodejs-whisper processes a malicious input, the injected commands are executed by the underlying shell with the privileges of the Node.js process. This poses a significant risk to any server or environment running applications that accept user-provided audio files for processing via this library.

Impact

Successful exploitation allows for arbitrary code execution on the host operating system. Depending on the privileges of the Node.js process, an attacker could achieve full system compromise, exfiltrate sensitive data, or move laterally within the network. This affects all applications relying on the vulnerable nodejs-whisper library for audio conversion tasks.

Recommendation

• Immediately update the nodejs-whisper dependency to a patched version once available; as of this report, developers should move to a secure alternative or apply strict input validation.
• Audit all application code that utilizes nodejs-whisper to identify if audio file paths are sourced from untrusted user input.
• Implement input sanitization to ensure that file names do not contain shell metacharacters such as $, (), or quotes before they are passed to system-level commands.
• Monitor process execution logs for suspicious child processes spawned by Node.js applications, specifically looking for shells or utility commands like ffmpeg being invoked with shell metacharacters in arguments.