CPE
The transcribe2texts package through version 1.0.6 is vulnerable to OS command injection via the transcribeAudio function, allowing unauthenticated attackers to achieve arbitrary code execution by injecting shell metacharacters into the audioPath parameter.