Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34981 The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, http://FileService.download_from_url() in app/services/file_service.py calls reque… https://www.cve.org/CVERecord?id=CVE-2026-34981
Post summary
The post announces CVE‑2026‑34981 for the whisperX API, detailing the affected function and version range, but lacks exploitation or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pavelzbornik | whisperx_rest_api | - | - | - |