EXPOSURES › CVE-2026-110640
CVE-2026-110640
CRITICALWhisper-node through 1.1.1 allows remote OS command injection via crafted filePath or whisperOptions.language parameters, enabling attackers to execute arbitrary commands with Node.js process privileges.
This OS command injection flaw lets attackers run arbitrary shell commands on affected systems by manipulating input parameters, directly enabling remote code execution. DIB organizations must patch this immediately as it bypasses application-level controls and grants attackers full system access, violating CMMC/NIST 800-171 requirements for patch management and system integrity. Organizations should verify their Whisper-node versions and apply updates to prevent lateral movement and data exfiltration.
Shame score — A critical OS command injection vulnerability in a Node.js library allows remote attackers to execute arbitrary commands with process privileges, representing a severe avoidable failure in secure coding practices.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.