whisper-node CVE-2026-110640

Exploitation requires an application that calls whisper-node's whisper() function and passes attacker-controlled data into the filePath argument or the whisperOptions.language option (and potentially modelPath); these values flow unescaped into the shell command built by createCppCommand() and executed via shelljs exec(). No special whisper-node configuration is needed - the vulnerable code path is the default in versions through 1.1.1. The key LIMITING factor is that whisper-node is a library, not a network service: it is only remotely exploitable if the embedding application accepts untrusted input for these parameters; applications that use only hard-coded or sanitized paths/languages are not exposed. Impact is bounded by the privileges of the Node.js process.

This is a genuine high-severity issue for any application that embeds whisper-node, but its real-world risk is gated by how the library is used rather than by the library existing on disk. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) and the 9.3 score describe a trivially exploitable, unauthenticated, network-reachable command injection with full VC:H/VI:H/VA:H impact, and the source-code evidence (PR #64) confirms the root cause: user-supplied filePath, modelPath, and whisperOptions.language were interpolated unescaped into a shell command string executed via shelljs exec(). However, whisper-node is a library function, not a listening service - the AV:N/PR:N rating is only realized when the host application forwards untrusted input into whisper(), so the 'unauthenticated network' framing is inherited from a hypothetical calling app, not from whisper-node itself. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation; the fix (quoting/shell-escaping via a POSIX single-quote helper) is confirmed available in PR #64. Net assessment: technically critical and easy to exploit where reachable, but likely targeted/opportunistic against specific applications rather than mass-exploited, given the niche footprint and absence of exploitation telemetry.

An application uses whisper-node to transcribe audio and passes a user-controlled filename or a 'language' option straight into whisper(). An attacker submits a value such as a filePath or language containing shell metacharacters or $(...) command substitution, which is concatenated into the './main ... -f <filePath>' command and executed by shelljs exec(), running arbitrary OS commands with the Node.js process privileges. No public exploit was identified at time of analysis, but the injection point is confirmed by the vendor patch diff.