CVE-2026-110640: Whisper-node through 1.1.1 OS Command Injection via filePath and language
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Applications using Whisper-node through 1.1.1 are exposed when untrusted input can reach the filePath argument or whisperOptions.language passed to whisper(). An attacker does not need authentication or user interaction when they can directly supply either value.
What privileges would injected commands receive?
Injected commands execute with the privileges of the Node.js process running the affected application. The impact therefore depends on the operating-system access, files, credentials, and network reachability available to that process.
Are shell metacharacters required for exploitation?
Yes. The issue is caused by crafted filePath or language values containing shell metacharacters or $() command substitution, which are incorporated into a command string and run through shelljs exec().
How can I determine whether an application is affected?
Check whether the application uses Whisper-node version 1.1.1 or earlier and calls whisper() with filePath or whisperOptions.language values that may be influenced by external users, requests, uploads, or other untrusted sources.