Vendor
The whisper-node library through version 1.1.1 is vulnerable to OS command injection via unsanitized input in the whisper() function, allowing attackers to execute arbitrary shell commands.