CVE-2026-110640

Deferred Deferred - Pending Action

Whisper-node OS Command Injection via Shell Metacharacters

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110640

EUVD

EUVD-2026-101268

Affected Vendors & Products

Vendor	Product	Version / Range
ariym	whisper-node	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in the whisper-node library through version 1.1.1. Attackers can execute arbitrary commands by injecting shell metacharacters or command substitutions into the filePath or whisperOptions.language parameters of the whisper() function. The issue occurs because user inputs are not properly sanitized before being passed to shelljs.exec(), allowing command execution with Node.js process privileges.

Detection Guidance

Check if whisper-node version 1.1.1 or earlier is installed using npm list whisper-node. If vulnerable, look for unexpected command execution in logs or system processes. Monitor network traffic for unusual outbound connections from Node.js processes.

Impact Analysis

An attacker could exploit this to run malicious commands on your system with the same privileges as the Node.js process. This could lead to unauthorized file access, data theft, system compromise, or denial of service. Any application using vulnerable versions of whisper-node may be affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected software may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade whisper-node to the latest patched version immediately. If upgrading is not possible, remove or disable the package. Implement input validation for filePath and language parameters. Restrict Node.js process permissions to minimize impact of potential exploits.

Hi! I’m here to help you understand CVE-2026-110640. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70