VulnSocial

CVE-2026-110644

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-14: 110-14
Referenced assets1 URL
Full discourse1 post
  • Security Arsenal, LLC@SecurityAr58409

    🔒 #CyberSecurity CVE-2026-110644 & 3 Critical FFmpeg Wrapper CVEs: OS Command Injection in Node.… "In the last 72 hours, NVD published four CRITICAL-severity CVEs — all carrying CVSS…" 🔗 https://securityarsenal.com/blog/cve-2026-110644-and-3-critical-ffmpeg-wrapper-cves-os-command-injection-in-nodejs-media-libraries-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve2026110644 #critical #cve

    0000037
    38 followersView on X

Explore more

Back to dashboard