CVE-2026-79535

Deferred Deferred - Pending Action

OS Command Injection in mbailey VoiceMode

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: MITRE

Description

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-30

EPSS Evaluated

2026-10-18

NVD

CVE-2026-79535

EUVD

EUVD-2026-89361

Affected Vendors & Products

Vendor	Product	Version / Range
mbailey	voicemode	to 8.10.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-79535 is an OS command injection vulnerability in the VoiceMode project (versions <= 8.10.1). The issue occurs when the update_config MCP tool or CLI writes a user-supplied value to ~/.voicemode/voicemode.env without proper shell-escaping. When the service starts, it sources this file using 'source .', which can execute malicious commands if the value contains shell metacharacters like $(...).

Detection Guidance

Check for the presence of the vulnerable config tools in ~/.voicemode/voicemode.env. Look for improperly escaped values or command injection patterns like VOICEMODE_VOICES='af_sky$(...)'. Inspect start scripts for 'source ~/.voicemode/voicemode.env' usage.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary commands on your system with the privileges of the VoiceMode service user. This could lead to data theft, system compromise, or further network infiltration. Exploitation requires access to the vulnerable config tools, which are not enabled by default.

Compliance Impact

This vulnerability could potentially allow arbitrary command execution on the system hosting the VoiceMode service, which may lead to unauthorized access to sensitive data. If exploited, it could result in data breaches, unauthorized modifications, or disclosure of personal or health information, depending on the data processed by the service. This could impact compliance with GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access or processing of regulated data.

Mitigation Strategies

Update to version 8.10.2 or later. Remove any malicious values from ~/.voicemode/voicemode.env. Ensure config tools are not used unless necessary. Verify start scripts no longer use 'source' for the env file.

Hi! I’m here to help you understand CVE-2026-79535. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70