Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110640Whisper-node through 1.1.1 OS Command Injection via filePath and language

Critical 9.8

In plain English

A critical-severity OS command injection in whisper-node from ariym. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.7%top 13.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.

Affected products (as reported)

Vendor	Product	Versions
ariym	whisper-node	0 – through 1.1.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/ariym/whisper-node/pull/64 patch, issue-tracking
https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L8 technical-description
https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L58 technical-description
https://unpkg.com/whisper-node@1.1.1/dist/index.js technical-description
VulnCheck Advisory: Whisper-node through 1.1.1 OS Command Injection via filePath and language third-party-advisory