nodejs-whisper CVE-2026-110644

Requires an application using nodejs-whisper (≤0.3.1) to pass an attacker-controlled file path or filename into convertToWavType() (or the transcription entry points that call it); the attacker-supplied name must contain shell metacharacters such as $() command substitution or a closing double-quote, which are interpolated into the ffmpeg command string run via shelljs exec(). Exploitation also requires ffmpeg to be installed and invocable on the host. Limiting factors: the attacker must be able to influence the filename/path string reaching the function, so applications that sanitize, canonicalize, or server-generate audio paths are not exposed; there is no authentication or user-interaction requirement in the library itself, and code runs with the Node.js process privileges.

This is a genuine high-priority defect for anyone embedding the library, though its blast radius is bounded by the product's niche footprint. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the confirmed root cause - unsanitized interpolation of a file path into a shell string executed via shelljs exec() - justify the 9.3 'critical' rating and are corroborated by the source-code diff in PR #259, which replaces shell.exec() with argv-array execFileSync(). However, the AV:N/PR:N rating is contingent on the consuming application forwarding attacker-controlled filenames to convertToWavType(); nodejs-whisper is a library, so exploitability depends on how downstream applications wire untrusted input, meaning the 'network/unauthenticated' framing holds only for apps that accept user-supplied audio paths. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a confirmed, mechanically-simple injection plus an available vendor patch means remediation should be straightforward and prioritized for affected integrators, but the absence of KEV/EPSS signals and the library's limited deployment suggest this is a real-but-not-widespread risk rather than a mass-exploitation event.

An application built on nodejs-whisper accepts an uploaded or user-named audio file and passes its path to convertToWavType(). An attacker names the file so it contains shell metacharacters (e.g. a $() command substitution or a closing double-quote), which is interpolated into the ffmpeg command and executed by shelljs, running arbitrary OS commands with the Node.js process's privileges. No public exploit is identified at time of analysis, but the technique is trivial given the confirmed code path.