Transcribe2Texts
Monthly
OS command injection in the transcribe2texts Node.js library through version 1.0.6 lets unauthenticated remote attackers execute arbitrary shell commands with the privileges of the Node.js process by supplying crafted audioPath values to transcribeAudio(). The flaw is a library sink rather than a directly exposed service: it is exploitable only where an integrating application passes attacker-influenced data into audioPath, which is concatenated unescaped into a python3 command line and run through child_process.exec(); applications that hardcode or strictly validate that path are not exposed. The critical 9.3 (CVSS 4.0) severity reflects network-reachable, low-complexity, no-privilege, no-interaction exploitation with high confidentiality, integrity and availability impact to the host, and while an upstream fix exists, no public exploit code has been identified at time of analysis.
OS command injection in the transcribe2texts Node.js library through version 1.0.6 lets unauthenticated remote attackers execute arbitrary shell commands with the privileges of the Node.js process by supplying crafted audioPath values to transcribeAudio(). The flaw is a library sink rather than a directly exposed service: it is exploitable only where an integrating application passes attacker-influenced data into audioPath, which is concatenated unescaped into a python3 command line and run through child_process.exec(); applications that hardcode or strictly validate that path are not exposed. The critical 9.3 (CVSS 4.0) severity reflects network-reachable, low-complexity, no-privilege, no-interaction exploitation with high confidentiality, integrity and availability impact to the host, and while an upstream fix exists, no public exploit code has been identified at time of analysis.