Summary
generated automatically from NVD dataWhisper-node, through version 1.1.1, has an OS command injection flaw (CWE-78) in its whisper() function. Crafted filePath or whisperOptions.language values can carry shell metacharacters or $() substitution into the command string built by createCppCommand() and executed through shelljs exec(). An attacker can thereby run arbitrary commands with the privileges of the Node.js process. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.
NVD description
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
EPSS · FIRST.org
2.7%probability of exploitation in the next 30 days
Higher than 85% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 14 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-78
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.