CVE WATCH / VULNERABILITY DETAIL
CVE-2026-110644
CRITICALCVSS 9.8NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ff
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-96615 MEDIUM 6.5
- CVE-2026-97205 HIGH 8.1
- CVE-2026-97629 MEDIUM 6.5
- CVE-2026-95101 MEDIUM 5.3
- CVE-2026-91184 HIGH 8.8
- CVE-2026-93479 HIGH 8.1
- CVE-2026-94197 HIGH 7.5
- CVE-2026-73800
- CVE-2026-73802
- CVE-2026-60021