OS Command Injection in mbailey VoiceMode

Executive Summary

CVE-2026-79535 is an OS command injection vulnerability in the VoiceMode project (versions <= 8.10.1). The issue occurs when the update_config MCP tool or CLI writes a user-supplied value to ~/.voicemode/voicemode.env without proper shell-escaping. When the service starts, it sources this file using 'source .', which can execute malicious commands if the value contains shell metacharacters like $(...).

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the vulnerable config tools in ~/.voicemode/voicemode.env. Look for improperly escaped values or command injection patterns like VOICEMODE_VOICES='af_sky$(...)'. Inspect start scripts for 'source ~/.voicemode/voicemode.env' usage.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary commands on your system with the privileges of the VoiceMode service user. This could lead to data theft, system compromise, or further network infiltration. Exploitation requires access to the vulnerable config tools, which are not enabled by default.

Useful 0 Not Useful 0

Mitigation Strategies

Update to version 8.10.2 or later. Remove any malicious values from ~/.voicemode/voicemode.env. Ensure config tools are not used unless necessary. Verify start scripts no longer use 'source' for the env file.

Useful 0 Not Useful 0