CVE-2026-110644

{
  "etk_id": "ETK-2026-1592",
  "cve_id": "CVE-2026-110644",
  "display_id": "CVE-2026-110644",
  "ghsa_id": "GHSA-2f48-3555-fpx6",
  "euvd_id": "EUVD-2026-101272",
  "status": "published",
  "anchor_state": "anchored",
  "title": "OS command injection in nodejs-whisper audio conversion",
  "summary": "nodejs-whisper versions through 0.3.1 are affected by OS command injection during audio conversion. An attacker who can supply an audio file path processed by the vulnerable function may run commands with the permissions of the Node.js service.",
  "mitigation": "Do not pass untrusted file paths to nodejs-whisper conversion, and restrict the Node.js service account's permissions. Isolate or disable exposed upload and conversion workflows until a maintained fixed release is available.",
  "vendor": "chetanxpro",
  "product": "nodejs-whisper",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.3.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [],
      "package_name": "nodejs-whisper",
      "purl": "pkg:npm/nodejs-whisper"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0273,
  "epss_percentile": 0.8588,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.515888016666665,
  "t0_at": "2026-10-14T14:17:13.817000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T14:17:13.817000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T14:17:13.817000+00:00",
      "url": "https://github.com/advisories/GHSA-2f48-3555-fpx6"
    }
  }
}