Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110643transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath

Critical 9.8

In plain English

A critical-severity OS command injection in transcribe2texts from kky-ykk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.

Affected products (as reported)

Vendor	Product	Versions
kky-ykk	transcribe2texts	0 – through 1.0.6

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/kky-ykk/Transcribe2texts/pull/1 patch, issue-tracking
https://github.com/kky-ykk/Transcribe2texts/blob/7e82f96466fed9ccfc40f7b9e370321701b82c32/lib/index.js#L53-L55 technical-description
VulnCheck Advisory: transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath third-party-advisory