Key points
- The vulnerability is tracked as CVE-2026-110644 and has a CVSS score of 9.3.
- Attackers exploit the convertToWavType() function by supplying crafted file names.
- The flaw affects the nodejs-whisper npm package through version 0.3.1.
The nodejs-whisper library contains a critical security flaw that lets attackers run operating system commands by tricking the software into processing malicious audio file paths. This vulnerability exists in versions up to 0.3.1 and allows unauthorized code execution with the privileges of the Node.js process. System administrators using this package must assess their exposure immediately to prevent potential system compromise through manipulated input data.
How it unfolded
- The National Vulnerability Database recorded CVE-2026-110644 for the nodejs-whisper library developed by ChetanXpro.
- Researchers identified an OS command injection weakness within the convertToWavType() function of the package.
- The flaw was assigned a CVSS score of 9.3, indicating a critical severity level for affected systems.
Who is affected
The nodejs-whisper npm package, maintained by ChetanXpro, is affected in all versions up to and including 0.3.1. Any application relying on this library to process audio files is potentially vulnerable. The weakness, categorized under CWE-78, allows attackers to execute arbitrary commands on the host system. This exposure occurs when the library processes audio file paths that contain specific malicious characters or syntax designed to break out of the intended command structure.
What happens next
No patch or update has been confirmed yet for this vulnerability. Administrators should monitor official channels from the package maintainer for a security release. Until a fix is available, teams may need to consider removing or isolating applications that depend on the vulnerable version of nodejs-whisper. The ability to execute commands with Node.js process privileges means that successful exploitation could lead to significant system control by an attacker.
The background in plain language
Command injection occurs when software passes user input to a system shell without proper sanitization. In this case, the library uses a tool to convert audio files. If an attacker can control the filename, they might insert special characters that the shell interprets as commands rather than text. This allows the attacker to run their own code on the server. Teams usually validate all file inputs and avoid passing them directly to shell commands to prevent such issues.
What to do and how to stay safe
- Audit your project dependencies to check if you are using nodejs-whisper version 0.3.1 or earlier.
- Review application logs for any unusual audio file paths or unexpected command executions on the server.
- Restrict file input permissions to prevent users from supplying arbitrary filenames to the vulnerable function.
- Monitor the official npm package page and security advisories for an updated version that resolves this issue.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
