---
id: CVE-2026-110640
title: >-
  Whisper-node through 1.1.1 contains an OS command injection vulnerability that
  allows attackers to execute commands by supplying crafted filePath or
  whisperOptions.language values to whisper()
summary: >-
  Whisper-node through 1.1.1 contains an OS command injection vulnerability that
  allows attackers to execute commands by supplying crafted filePath or
  whisperOptions.language values to whisper(). Attackers can inject shell
  metacharacters o…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T15:17:17.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110640'
references:
  - url: >-
      https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L58
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L8
    label: disclosure@vulncheck.com
  - url: 'https://github.com/ariym/whisper-node/pull/64'
    label: disclosure@vulncheck.com
  - url: 'https://unpkg.com/whisper-node@1.1.1/dist/index.js'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/whisper-node-through-1.1.1-os-command-injection-via-filepath-and-language
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.014Z'
---

## Overview

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.