CVE WATCH / VULNERABILITY DETAIL
CVE-2026-110640
CRITICALCVSS 9.8NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCo
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-96615 MEDIUM 6.5
- CVE-2026-97205 HIGH 8.1
- CVE-2026-97629 MEDIUM 6.5
- CVE-2026-95101 MEDIUM 5.3
- CVE-2026-91184 HIGH 8.8
- CVE-2026-93479 HIGH 8.1
- CVE-2026-94197 HIGH 7.5
- CVE-2026-73800
- CVE-2026-73802
- CVE-2026-60021