Cpe:2.3:a:nodejs-Whisper_project:nodejs-Whisper:*:*:*:*:*:node.js:*:*

The nodejs-whisper package through version 0.3.1 contains an OS command injection vulnerability in the convertToWavType() function that allows unauthenticated command execution via crafted audio file paths.