{"metadata": {"vulnerability": "CVE-2026-110640", "count": 13, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-06-25T00:00:00Z", "date_only": false, "value": "2026-06-25T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110640", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:33.433Z", "date_only": false, "value": "2026-10-14T13:07:33.433Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110640", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:11.249Z", "date_only": false, "value": "2026-10-14T14:17:11.249Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110640", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:11.249Z", "date_only": false, "value": "2026-10-14T14:17:11.249Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110640", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T14:17:11.249Z", "date_only": false, "value": "2026-10-14T14:17:11.249Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110640", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:17Z", "date_only": false, "value": "2026-10-14T15:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-4WMJ-6XHG-GXHM", "record": "GHSA-4WMJ-6XHG-GXHM", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:17.277Z", "date_only": false, "value": "2026-10-14T15:17:17.277", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110640", "record": "FKIE_CVE-2026-110640", "field": "published"}, {"timestamp": "2026-10-14T15:32:27Z", "date_only": false, "value": "2026-10-14T15:32:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4WMJ-6XHG-GXHM", "record": "GHSA-4WMJ-6XHG-GXHM", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4WMJ-6XHG-GXHM", "record": "GHSA-4WMJ-6XHG-GXHM", "field": "modified"}, {"timestamp": "2026-10-14T16:09:31.928Z", "date_only": false, "value": "2026-10-14T16:09:31.928881Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwo2dexp2o", "record": "CVE-2026-110640", "field": "creation_timestamp", "uuid": "edc20faa-fd80-47f6-8b74-f2c600606c24", "content": "\ud83d\udea8 CVE-2026-110640 \u2014 CVSS 9.3 CRITICAL\n\nWhisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110640\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwo2dexp2o"}, {"timestamp": "2026-10-14T16:40:06.317Z", "date_only": false, "value": "2026-10-14T16:40:06.317133Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtyepscvv2n", "record": "CVE-2026-110640", "field": "creation_timestamp", "uuid": "40740288-2684-4640-9283-0a85e563a4d8", "content": "CVE-2026-110640 - whisper-node\nThe whisper-node library (versions up to 1.1.1) can be tricked into running any command the Node.js process can execute if an attacker controls the filePath or language\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#whispernode #ariym #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtyepscvv2n"}, {"timestamp": "2026-10-14T19:42:14.607Z", "date_only": false, "value": "2026-10-14T19:42:14.607952Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440966134816171", "record": "CVE-2026-110640", "field": "creation_timestamp", "uuid": "35461506-18ae-451e-8da0-d19d74036530", "content": "CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110640https://github.com/ariym/whisper-node/pull/64https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L8https://github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src/whisper.ts#L58https://unpkg.com/whisper-node@1.1.1/dist/index.jshttps://www.vulncheck.com/advisories/whisper-node-through-1.1.1-os-command-injection-via-filepath-and-language#ariym #whisper-node#CVE_2026_110640#bot", "url": "https://infosec.exchange/users/cve/statuses/117440966134816171"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110640", "record": "FKIE_CVE-2026-110640", "field": "lastModified"}]}