Veille CVE

Recherche « ChetanXpro nodejs-whisper »

1 CVE

Critique 1 Élevée 0 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « ChetanXpro nodejs-whisper » ✕
  1. CVE-2026-110644 9.8 Critique

    ChetanXpro nodejs-whisper

    nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.