nodejs-whisper: OS command injection via crafted audio file paths

Summary

The npm package nodejs-whisper, a Node.js wrapper around OpenAI's Whisper speech-to-text model, is affected up to version 0.3.1. The function convertToWavType() interpolates the file name or path of an audio file into an ffmpeg command that is run through a shell. An attacker who can supply a crafted file name containing command substitution or quote characters can execute arbitrary OS commands with the privileges of the Node.js process. The risk is highest where an internet-facing application accepts audio uploads and passes the original file name to the library.

Affected

• nodejs-whisper (npm) versions 0 to 0.3.1
• Provisional: the NVD analysis is still pending and the affected range may change.

Fixed in

• Unknown. Sources conflict: GHSA-2f48-3555-fpx6 lists 0.4.0, Positive Technologies refers to versions before 0.3.2. No verified fixed release found.
• The proposed fix (PR #259, not merged as of the latest research) runs ffmpeg without a shell.

Workaround

• No vendor workaround found.
• Do not pass user-supplied file names or paths directly to the library; store uploads under server-generated names such as random IDs.
• Run the service as a least-privilege user in a container without access to secrets or sensitive directories.
• Place the service behind authentication and limit who can submit audio.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV.
• No public exploits listed in Exploit-DB.
• The mechanism is publicly described; EPSS rates exploitation as unlikely (2.73%).
• CISA SSVC: automatable yes, total technical impact.

Our recommendation

• Check whether the library is used directly or indirectly (npm ls nodejs-whisper).
• If used, avoid passing untrusted file names to it and apply the workarounds above.
• Update only to a release you have verified contains the fix, or patch the code as proposed in PR #259.
• Monitor the upstream repository and GitHub advisory for a confirmed fixed version.
• Review application logs for unusual file names or unexpected child processes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory (CVE description, CVSS) www.vulncheck.com
• Upstream fix proposal PR #259 github.com
• Vulnerable code at v0.3.1 (lines 58-59) github.com
• Vulnerable code at v0.3.1 (lines 76-77) github.com
• GitHub advisory database thread github.com
• OSV GHSA-2f48-3555-fpx6 osv.dev
• Positive Technologies PT-2026-114086 vulners.com
• Tenable CVE page www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:05.