{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/transcribe2texts--1.0.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:transcribe2texts:transcribe2texts:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110643"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["transcribe2texts (\u003c= 1.0.6)"],"_cs_severities":["critical"],"_cs_tags":["command-injection","vulnerability","nodejs","code-execution"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe transcribe2texts package, specifically versions 1.0.6 and earlier, contains a critical OS command injection vulnerability. The vulnerability resides in the transcribeAudio function, which fails to properly sanitize the audioPath input before passing it to the child_process.exec() function. An attacker can supply a crafted audioPath string containing shell metacharacters such as $() or backticks, effectively breaking out of the intended path string to execute arbitrary OS commands. The commands are executed with the privileges of the Node.js process running the library, which could lead to full system compromise depending on the execution context. This flaw is classified as critical, with a CVSS v3.1 base score of 9.8, necessitating an immediate update for any application utilizing this library to handle user-supplied audio paths.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the server hosting the Node.js application. This could result in unauthorized data access, exfiltration of sensitive information, or complete system takeover. The scope of impact is broad, affecting any software product that integrates this library and exposes the vulnerable transcribeAudio function to untrusted input.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade the transcribe2texts dependency to a patched version beyond 1.0.6 if available.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing transcribe2texts to identify instances where user-supplied input is passed to the transcribeAudio function.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation or sanitization for all file path parameters before passing them to backend functions.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege by ensuring the Node.js process runs under a service account with restricted filesystem and network access to contain potential exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:33:46Z","date_published":"2026-10-14T16:33:46Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110643/","summary":"The transcribe2texts package through version 1.0.6 is vulnerable to OS command injection via the transcribeAudio function, allowing unauthenticated attackers to achieve arbitrary code execution by injecting shell metacharacters into the audioPath parameter.","title":"OS Command Injection in transcribe2texts","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-110643/"}],"language":"en","title":"CraftedSignal Threat Feed - Transcribe2texts (\u003c= 1.0.6)","version":"https://jsonfeed.org/version/1.1"}