External risk intelligence

nodejs-whisper OS command injection vulnerability in convertToWavType

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110644

The vulnerability exists in a Node.js library used for audio processing. While such libraries are often integrated into web applications that may handle user-uploaded files, the library itself is a backend component rather than a standalone internet-facing service. Exposure depends entirely on whether an application using this library accepts and processes untrusted file paths from the public internet.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Node.js audio processing library could allow attackers to execute commands on servers by providing specially crafted audio file paths. This could potentially lead to unauthorized command execution with the privileges of the Node.js process.

A library flaw allows remote command execution.
Leadership should recall this for potential exposure.
Confirm relevance and assess any potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted audio file paths to an application using the vulnerable Node.js library. This could happen if the application's input for file paths is not properly sanitized before being passed to the `convertToWavType()` function. If successful, the attacker could execute arbitrary operating system commands with the privileges of the running Node.js process.

Unrestricted network access required.
Crafted audio file paths trigger vulnerability.
Arbitrary command execution possible.

Live Threat

Current exploitation, exposure, and threat context

The `convertToWavType()` function in `nodejs-whisper` could allow an attacker to execute arbitrary operating system commands. This may occur when the application processes audio file paths provided by an attacker, which could include specially crafted strings that are then interpreted as commands by the underlying shell execution. The commands would run with the same privileges as the Node.js process.

OS commands could be executed.
Crafted audio file paths.
Compromised server processes.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OS command injection vulnerability in `nodejs-whisper` affects applications processing audio files. The primary responsibility for remediation likely falls on the application owners or development teams who integrated this library. The first practical step is to identify all instances of `nodejs-whisper`, determine their reachability and criticality, and then engage with the accountable teams to plan a risk-based remediation strategy.

Application owners should manage remediation.
Verify affected technology and reachability.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is nodejs-whisper and what is it used for?

nodejs-whisper is a JavaScript library designed to facilitate audio processing tasks within Node.js environments. Developers typically integrate this package into applications that need to manipulate or convert audio formats programmatically, often acting as a backend bridge to underlying system tools like ffmpeg to handle complex media file operations.

What does OS command injection mean for CVE-2026-110644?

This vulnerability falls under the weakness class of OS Command Injection (CWE-78). It means the software does not properly filter user input before using it to construct system commands. In this case, an attacker can insert special characters into an audio file path, causing the system to mistakenly execute those characters as separate, unauthorized operating system commands with the same permissions as the application itself.

How can an attacker trigger this vulnerability?

The flaw is triggered when an application passes a malicious, crafted audio file path into the library's convertToWavType() function. If the file path contains command-chaining syntax like shell substitution or special quotes, the underlying shell interprets them as instructions. Simply using the library to process trusted, locally generated, or static file paths does not inherently trigger this vulnerability.

Is my system at risk?

According to Halo Surface Signal, risk depends on how your application uses the library. If your application processes untrusted file paths provided directly or indirectly by users over the public internet, it may be reachable. The library is a backend component, so it is only as exposed as the specific application interface that accepts and handles external input for it.

What steps should I take to respond to this issue?

Begin by auditing your software inventory to locate where nodejs-whisper is implemented. Once identified, evaluate whether those applications accept user-provided file paths. Prioritize discussing these findings with your development or application ownership teams to determine if the library can be updated or if input validation logic needs to be strengthened to block malicious path strings.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.