9.3 CVSS: Whisper-node v1.1.1 OS Command Injection Grants Node.js Privileges
A critical OS command injection vulnerability in Whisper-node versions up to 1.1.1 lets attackers run arbitrary commands with Node.js process privileges.
Key points
- CVE-2026-110640 is rated CVSS 9.3 Critical by the National Vulnerability Database.
- The flaw affects Whisper-node versions through 1.1.1 developed by ariym.
- Attackers can exploit the issue via crafted filePath or language inputs.
The National Vulnerability Database has published CVE-2026-110640, a critical security flaw in Whisper-node. This vulnerability affects versions of the software up to and including 1.1.1. The record indicates that attackers can execute commands by supplying crafted inputs to the application.
The vulnerability stems from improper input validation within the whisper() function. According to the NVD record, attackers can supply crafted values for filePath or whisperOptions.language parameters. These inputs are passed to createCppCommand(), which builds a command string executed by shelljs exec(). This allows the injection of shell metacharacters or dollar-parenthesis substitutions.
Technical context
The underlying weakness is classified as CWE-78, indicating improper neutralization of special elements used in an OS command. The National Vulnerability Database assigns a CVSS score of 9.3, marking the severity as Critical. The flaw enables an attacker to execute arbitrary commands with the same privileges as the Node.js process running the application.
Affected systems
The vulnerability impacts Whisper-node software versions through 1.1.1. The vendor is identified as ariym in the advisory records. Any organization utilizing these specific versions of the tool is potentially exposed to this attack vector. Users who have not updated their installations remain vulnerable to exploitation.
Defender's checklist
Security teams should inventory all instances of Whisper-node across their infrastructure. Verify the version numbers against the affected range listed in the advisory. Monitor logs for unusual shell activity or unexpected command executions originating from Node.js processes. Isolate affected systems if exploitation is suspected to prevent lateral movement within the network.
Operational impact
Organizations must immediately review their supply chain dependencies for this component. Teams usually need to coordinate with development and operations groups to assess exposure. Check whether the tool processes untrusted data, which increases risk. Internal stakeholders, including risk management and legal, should be informed of the potential breach implications. Establish a communication plan to address any service disruptions during remediation efforts.
What to do and how to stay safe: Whisper-node
- Audit your software inventory to identify any installations of Whisper-node versions 1.1.1 or earlier.
- Restrict network access to systems running this software until a secure configuration is confirmed.
- Monitor system logs for anomalous command executions or unexpected process spawns by the Node.js runtime.
- Wait for the vendor to release a patched version before resuming normal operations with untrusted inputs.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this Whisper-node vulnerability?
The vulnerability is tracked as CVE-2026-110640.
How severe is this command injection flaw?
The National Vulnerability Database rates it as Critical with a CVSS score of 9.3.
Which versions of Whisper-node are affected?
All versions of Whisper-node up to and including 1.1.1 are affected.
