CVE-2026-110640

{
  "etk_id": "ETK-2026-1594",
  "cve_id": "CVE-2026-110640",
  "display_id": "CVE-2026-110640",
  "ghsa_id": "GHSA-4wmj-6xhg-gxhm",
  "euvd_id": "EUVD-2026-101268",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in ariym whisper-node",
  "summary": "ariym whisper-node through version 1.1.1 is affected by OS command injection. An attacker may run commands with the permissions of the Node.js process when they can supply untrusted values to the file-path or language inputs used by whisper().",
  "mitigation": "Do not pass untrusted input to whisper() file-path or language options; restrict those values to application-controlled allowlists and isolate the Node.js process with minimal privileges. Update to a vendor-fixed release when one is confirmed; the supplied evidence does not identify a fixed version.",
  "vendor": "ariym",
  "product": "whisper-node",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.1.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "whisper-node",
      "purl": "pkg:npm/whisper-node"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0273,
  "epss_percentile": 0.8588,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.03337548333333,
  "t0_at": "2026-10-14T14:17:11.249000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T14:17:11.249000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T14:17:11.249000+00:00",
      "url": "https://github.com/advisories/GHSA-4wmj-6xhg-gxhm"
    }
  }
}