Threats affecting pkg:github/mbailey/voicemode

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.3	EPSS 0.5%	CVE-2026-79535voicemode · OS Command Injection Medium6.3EPSS 0.5%2026-09-29CVE Database V5CVE-2026-79535 mbailey VoiceMode versions up to and including 8.10.1 contain an OS command injection vulnerability. This occurs because the update_config MCP tool and the "voicemode config set" CLI command write user-supplied input into the ~/.voicemode/voicemode.env file without proper shell escaping. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. EPSS 0.5%Vulnerability CWE-78	CVE Database V5	2026-09-29

Page 1 of 1