Threat database

nodejs-whisper versions up to 0.3.1 contain an OS command injection vulnerability in the convertToWavType() function. This flaw allows attackers to execute arbitrary OS commands by supplying specially crafted audio file paths that include command substitution syntax. The vulnerability arises because these inputs are interpolated unsafely into an ffmpeg command executed via shelljs exec(), running with Node.js process privileges. The CVSS 4.0 score is 9.3, indicating critical severity.