CVE-2026-110644: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ChetanXpro nodejs-whisper

CVE-2026-110644 is an OS command injection vulnerability in the nodejs-whisper package through version 0.3.1. The vulnerability exists in the convertToWavType() function, which constructs an ffmpeg command using user-supplied audio file paths. Attackers can exploit this by providing file names containing shell command substitution syntax such as $() or closing quotes, which are interpolated into the shell command executed by shelljs exec(). This allows execution of arbitrary OS commands with the privileges of the Node.js process running the application.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands on the host running nodejs-whisper, potentially leading to full system compromise depending on the privileges of the Node.js process. The vulnerability is remotely exploitable without user interaction and requires no privileges, making it highly critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input in file paths passed to convertToWavType() or the underlying ffmpeg command. Consider applying input validation or sanitization to prevent command injection. Monitor vendor channels for an official patch or update.