Attack Chain

1. The attacker identifies an application utilizing the vulnerable whisper-node library (<= 1.1.1) to process user-supplied file paths or language options.
2. The attacker crafts a malicious input string containing shell metacharacters (e.g., ;, &&, |) or command substitution syntax ($()).
3. The attacker submits the crafted input via an API endpoint or user interface that interfaces with the whisper() function.
4. The whisper() function passes the malicious input to the createCppCommand() internal helper.
5. The helper fails to sanitize the input and concatenates it into a shell command string.
6. The application invokes shelljs.exec() with the concatenated, malicious string.
7. The Node.js process executes the injected commands, resulting in unauthorized command execution.
8. The attacker achieves their objective, such as initial access, data exfiltration, or lateral movement.

Impact

Successful exploitation of this vulnerability allows for remote code execution on the server hosting the Node.js application. Depending on the environment and the privileges of the Node.js process, an attacker could compromise sensitive data, gain persistence, or leverage the host machine to pivot into internal networks. The vulnerability is highly critical due to the ease of injection and the widespread use of such libraries in media-processing services.

Recommendation

Prioritize the immediate update of the whisper-node dependency to a patched version (if available) or implement strict input validation for all values passed to the whisper() function. Ensure that no user-supplied data is passed directly into shell-executing functions.