@ai16z/client-telegram (>=0.1.1, <=0.1.4-alpha.3), @ai16z/plugin-node (>=0.1.1, <=0.1.6) +43 more potentially affected by CVE-2026-110644 via nodejs-whisper (>=0.1.18, <=0.3.1)

nodejs-whisper NPM version =0.1.18, =0.1.1, =0.1.1, =0.1.0, =0.2.0, =0.56.0, =1.0.0, =1.0.0-alpha.20, =0.1.9, =0.1.8-alpha.1, =0.25.6-alpha.1, =2.0.0-alpha.3, =0.1.8-alpha.1, =0.1.7-alpha.2, =1.0.0-beta.8, =1.0.0-beta.49 - @evmagikit/plugin-holoworld 0.1.0 and more Source cves: CVE-2026-110644...

nodejs-whisper allows OS command injection through crafted audio file paths

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

EUVD-2026-101272

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644

The nodejs-whisper library, version 0.3.1 and earlier , is vulnerable to OS Command Injection within the convertToWavType() function. The root cause is the insufficient sanitization of audio file paths, allowing attackers to inject $() command substitution or closing quotes. These inputs are inte...

CVE-2026-110644

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644: Improper Neutralization of Special Elements used in an OS Command

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

PT-2026-114086

Name of the Vulnerable Software and Affected Versions nodejs-whisper versions prior to 0.3.2 Description An OS command injection issue exists in the convertToWavType function. This occurs when crafted audio file paths containing closing quotes or $ command substitution are supplied. These inputs...