CVE-2026-110644

Name of the Vulnerable Software and Affected Versions nodejs-whisper versions prior to 0.3.2

Description An OS command injection issue exists in the convertToWavType() function. This occurs when crafted audio file paths containing closing quotes or $() command substitution are supplied. These inputs are interpolated into an ffmpeg command executed via shelljs exec(), allowing the execution of arbitrary OS commands with Node.js process privileges.

Recommendations Update nodejs-whisper to version 0.3.2 or later. As a temporary workaround, restrict the use of the convertToWavType() function or validate audio file paths to ensure they do not contain shell metacharacters.