CVE-2026-110643: transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to childprocess.exec() to run commands with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
An attacker must be able to supply a crafted audioPath value to transcribeAudio(). The vulnerable code passes that path unescaped to child_process.exec(), allowing shell metacharacters such as $(), backticks, or a closing quote to inject commands.
What privileges would injected commands have?
Injected commands run with the privileges of the Node.js process that invokes transcribeAudio(). The impact therefore depends on the operating-system permissions and accessible data available to that process.
Are unauthenticated remote attackers affected by default?
The issue does not require privileges or user interaction according to the supplied severity vector, but exploitation still depends on an attacker being able to reach an application path that passes attacker-controlled input into transcribeAudio() as audioPath.
Which versions are affected?
transcribe2texts through version 1.0.6 is affected.