CVE-2026-110644

The nodejs-whisper library, version 0.3.1 and earlier , is vulnerable to OS Command Injection within the convertToWavType() function. The root cause is the insufficient sanitization of audio file paths, allowing attackers to inject $() command substitution or closing quotes. These inputs are inte...

EUVD-2026-101272

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

AlmaLinux 8 : nodejs:24 (ALSA-2026:74085)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74085 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificate...

CVE-2026-110644: Improper Neutralization of Special Elements used in an OS Command

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

ninjasworkout

Aplicación NodeJS Vulnerable a Propósito Inicio Rápido Download the Repo = run npm i Después de instalar todas las dependencias, simplemente ejecute la aplicación node app.js or nodemon app.js VULNERABILIDADES AGREGADAS Contaminación de Prototipos ✅1 Inyección NoSQL ✅2 Cross-site Scripting XSS ✅3...

prithvi

Prithvi Una herramienta de generación de informes para evaluación de seguridad Uso Este proyecto nuestro se puede utilizar para la generación de informes y es muy fácil de usar. Incluye las siguientes características 1. Podemos agregar tipos Owasp y recomendaciones con detalles. 2. Podemos agrega...

dvna

Aplicación NodeJS Vulnerable a Propósito DVNA La Aplicación NodeJS Vulnerable a Propósito DVNA es una aplicación NodeJS simple para demostrar las Vulnerabilidades del Top 10 de OWASP y guiar sobre cómo corregir y evitar estas vulnerabilidades. La rama de fixes contendrá las correcciones para las...

nodejs:22 security update

nodejs 1:22.23.2-2 - Patches Pacote CVE and update undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259889 RHEL-255272 1:22.23.2-1 - Update to version 22.23.2 Fixes: CVE-2026-56846 CVE-2026-56848 CVE-2026-58043 Resolves: RHEL-234381 RHEL-234831 RHEL-234896 1:22.23.1-3 - deps:...

nodejs:22 security update

nodejs 1:22.23.2-2 - Patches pacote CVE and updates undici to 6.28.1 Fixes: CVE-2026-9496 CVE-2026-19534 Resolves: RHEL-259888 RHEL-255268 nodejs-nodemon 3.1.14-2 - Rebase npm/brace-expansion to 5.0.9 Fixes: CVE-2026-69152 Resolves: RHEL-223760 nodejs-packaging 2021.06-4 - Exclude ix86 arches fro...

BIT-THRIFT-2026-96294 Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94646 Apache Thrift: Node.js `server.js` ends the process on any per-connection error (+ two triggers)

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

BIT-THRIFT-2026-86535 Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely

Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-109211

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109212

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

PT-2026-109184

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_76750)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676750 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

Oracle Linux 8 : nodejs:24 (ELSA-2026-74085)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-74085 advisory. - Update to version 24.21.0 Fix: CVE-2026-85152 CVE-2026-84961 CVE-2026-19534 Resolves: RHEL-255252 RHEL-255291 RHEL-255313 RHEL-249188 - deps: update...

PT-2026-109229

Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...