Whisper Node
Monthly
OS command injection in the whisper-node npm package through version 1.1.1 allows remote, unauthenticated attackers to run arbitrary shell commands with the privileges of the embedding Node.js process whenever an application passes attacker-controlled data into whisper()'s filePath argument or the whisperOptions.language (and potentially modelPath) options. The vulnerable code path is the default in all versions up to and including 1.1.1, with no special configuration required, although real-world exposure is gated by how the library is used: whisper-node is a library, not a network service, so only applications that feed it untrusted input are remotely exploitable, and impact is bounded by the Node.js process privileges. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the upstream fix appears in GitHub PR #64 but a released patched version could not be independently confirmed from the available data.
OS command injection in the whisper-node npm package through version 1.1.1 allows remote, unauthenticated attackers to run arbitrary shell commands with the privileges of the embedding Node.js process whenever an application passes attacker-controlled data into whisper()'s filePath argument or the whisperOptions.language (and potentially modelPath) options. The vulnerable code path is the default in all versions up to and including 1.1.1, with no special configuration required, although real-world exposure is gated by how the library is used: whisper-node is a library, not a network service, so only applications that feed it untrusted input are remotely exploitable, and impact is bounded by the Node.js process privileges. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the upstream fix appears in GitHub PR #64 but a released patched version could not be independently confirmed from the available data.