Nodejs Whisper
Monthly
OS command injection in nodejs-whisper through 0.3.1 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by supplying a crafted audio file path. The vulnerable convertToWavType() function builds an ffmpeg command as a string, interpolating the caller-provided path between double quotes before handing it to shelljs exec(); a filename containing $() command substitution or a closing double quote breaks out of the quoted argument and is interpreted by the shell. An upstream fix exists in pull request #259, but no tagged patched release has been independently confirmed, and no public exploit code was identified at time of analysis - real-world exposure is limited to applications that pass attacker-influenced, unsanitized filenames into the transcription/convert entry points while ffmpeg is installed on the host.
OS command injection in nodejs-whisper through 0.3.1 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by supplying a crafted audio file path. The vulnerable convertToWavType() function builds an ffmpeg command as a string, interpolating the caller-provided path between double quotes before handing it to shelljs exec(); a filename containing $() command substitution or a closing double quote breaks out of the quoted argument and is interpreted by the shell. An upstream fix exists in pull request #259, but no tagged patched release has been independently confirmed, and no public exploit code was identified at time of analysis - real-world exposure is limited to applications that pass attacker-influenced, unsanitized filenames into the transcription/convert entry points while ffmpeg is installed on the host.