PT-2026-20346

CVE-2026-2629

Published

2026-02-17

Updated

2026-02-20

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jishi node-sonos-http-api versions prior to 3776f0ee2261c924c7b7204de121a38100a08ca7

Description A flaw exists in jishi node-sonos-http-api that could allow for remote execution of operating system commands. The issue is related to the manipulation of the phrase argument within the Promise function located in the lib/tts-providers/mac-os.js file of the TTS Provider component. The exploit for this issue has been publicly released.

Recommendations Update jishi node-sonos-http-api to a version later than 3776f0ee2261c924c7b7204de121a38100a08ca7.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers