CVE-2026-110643: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in kky-ykk transcribe2texts

CVE-2026-110643 describes an OS command injection vulnerability in the kky-ykk transcribe2texts package through version 1.0.6. The vulnerability occurs because the transcribeAudio() function passes an unescaped audioPath parameter directly to Node.js child_process.exec(), enabling attackers to inject shell commands via special characters like $(), backticks, or closing quotes. This allows execution of arbitrary commands with the privileges of the Node.js process running the application.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the host running transcribe2texts, potentially leading to full system compromise depending on the Node.js process privileges. The vulnerability does not require user interaction or privileges and has high impact on confidentiality, integrity, and availability as reflected by the CVSS 4.0 score of 9.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input in the audioPath parameter or sanitize inputs to prevent shell metacharacter injection. Consider restricting execution privileges of the Node.js process as a temporary mitigation.