EXPOSURES › CVE-2026-110643
CVE-2026-110643
CRITICALCVE-2026-110643 is an OS command injection flaw in transcribe2texts allowing attackers to execute arbitrary commands via crafted audioPath inputs.
The transcribe2texts library through version 1.0.6 fails to properly sanitize the audioPath parameter passed to child_process.exec(), enabling remote attackers to inject shell commands using $() or backtick substitution. DIB organizations must patch this immediately as it grants attackers Node.js process privileges, potentially leading to full system compromise, data exfiltration, or ransomware deployment. This is a critical unpatched vulnerability that should be treated as actively exploitable until patched.
Shame score — A critical OS command injection vulnerability in a text/audio processing library allows arbitrary code execution with Node.js privileges, representing a severe avoidable failure in input validation and sanitization.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.