CVE-2026-110644: nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using nodejs-whisper through 0.3.1 are exposed when they pass attacker-controlled audio file paths to convertToWavType(). The injected commands run with the privileges of the Node.js process.
What does an attacker need to exploit it?
An attacker needs a way to supply or influence an audio file path processed by convertToWavType(). Crafted filenames containing $() command substitution or closing quotes can alter the ffmpeg command executed through shelljs exec().
How can I determine whether my application is affected?
Check whether your application uses nodejs-whisper version 0.3.1 or earlier and whether untrusted users can control filenames or paths that reach convertToWavType(). Review paths passed into audio conversion, especially where filenames originate from uploads or other external input.