{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nodejs-whisper--0.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nodejs-whisper_project:nodejs-whisper:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110644"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nodejs-whisper (\u003c= 0.3.1)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe nodejs-whisper library, specifically versions 0.3.1 and earlier, contains a critical OS command injection vulnerability within the convertToWavType() function. This vulnerability arises because the package uses the shelljs exec() function to invoke the ffmpeg utility to process audio files. The library fails to sanitize user-supplied file paths, allowing an attacker to inject shell metacharacters such as command substitution ($()) or closing quotes into the command string. When an application utilizing nodejs-whisper processes a malicious input, the injected commands are executed by the underlying shell with the privileges of the Node.js process. This poses a significant risk to any server or environment running applications that accept user-provided audio files for processing via this library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the host operating system. Depending on the privileges of the Node.js process, an attacker could achieve full system compromise, exfiltrate sensitive data, or move laterally within the network. This affects all applications relying on the vulnerable nodejs-whisper library for audio conversion tasks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the nodejs-whisper dependency to a patched version once available; as of this report, developers should move to a secure alternative or apply strict input validation.\u003c/li\u003e\n\u003cli\u003eAudit all application code that utilizes nodejs-whisper to identify if audio file paths are sourced from untrusted user input.\u003c/li\u003e\n\u003cli\u003eImplement input sanitization to ensure that file names do not contain shell metacharacters such as $, (), or quotes before they are passed to system-level commands.\u003c/li\u003e\n\u003cli\u003eMonitor process execution logs for suspicious child processes spawned by Node.js applications, specifically looking for shells or utility commands like ffmpeg being invoked with shell metacharacters in arguments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:33:54Z","date_published":"2026-10-14T16:33:54Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nodejs-whisper-command-injection/","summary":"The nodejs-whisper package through version 0.3.1 contains an OS command injection vulnerability in the convertToWavType() function that allows unauthenticated command execution via crafted audio file paths.","title":"OS Command Injection in nodejs-whisper","url":"https://feed.craftedsignal.io/briefs/2026-10-nodejs-whisper-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Nodejs-Whisper (\u003c= 0.3.1)","version":"https://jsonfeed.org/version/1.1"}