Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

whisper-node up to 1.1.1 lets attackers run commands

CVE-2026-110640 · published 24 days ago
Summary

The whisper-node library (versions up to 1.1.1) can be tricked into running any command the Node.js process can execute if an attacker controls the filePath or language parameters. This could let an attacker take actions on your server, such as installing software or stealing data. Update to a newer version of whisper-node or apply the vendor’s fix to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ariym whisper-node <= 1.1.1
Original advisory text
Whisper-node through 1.1.1 OS Command Injection via filePath and language
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published14 Oct 2026
Updated7 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-110640 · NVD
CVE-2026-110640 · MITRE
Track software like this
Free during beta