Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110644nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

Critical 9.8

In plain English

A critical-severity OS command injection in nodejs-whisper from ChetanXpro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.7%top 13.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	nodejs-whisper	0.4.0	GHSA-2f48-3555-fpx6

Affected products (as reported)

Vendor	Product	Versions
ChetanXpro	nodejs-whisper	0 – through 0.3.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/ChetanXpro/nodejs-whisper/pull/259 patch, issue-tracking
https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59 technical-description
https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77 technical-description
VulnCheck Advisory: nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType third-party-advisory