{"metadata": {"vulnerability": "CVE-2026-110644", "count": 16, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-06-23T00:00:00Z", "date_only": false, "value": "2026-06-23T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110644", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-14T13:07:34.779Z", "date_only": false, "value": "2026-10-14T13:07:34.779Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110644", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T14:17:13.817Z", "date_only": false, "value": "2026-10-14T14:17:13.817Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110644", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:13.817Z", "date_only": false, "value": "2026-10-14T14:17:13.817Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-110644", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:17Z", "date_only": false, "value": "2026-10-14T15:17:17Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-2F48-3555-FPX6", "record": "GHSA-2F48-3555-FPX6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T15:17:17.940Z", "date_only": false, "value": "2026-10-14T15:17:17.940", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110644", "record": "FKIE_CVE-2026-110644", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-2F48-3555-FPX6", "record": "GHSA-2F48-3555-FPX6", "field": "published"}, {"timestamp": "2026-10-14T15:32:28Z", "date_only": false, "value": "2026-10-14T15:32:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-2F48-3555-FPX6", "record": "GHSA-2F48-3555-FPX6", "field": "modified"}, {"timestamp": "2026-10-14T16:09:49.562Z", "date_only": false, "value": "2026-10-14T16:09:49.562194Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwol7qxh2o", "record": "CVE-2026-110644", "field": "creation_timestamp", "uuid": "106cd7b5-d0fb-41f1-8e45-4d7a425e7af5", "content": "\ud83d\udea8 CVE-2026-110644 \u2014 CVSS 9.3 CRITICAL\n\nnodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110644\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwol7qxh2o"}, {"timestamp": "2026-10-14T16:50:06.814Z", "date_only": false, "value": "2026-10-14T16:50:06.814410Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtywmhx242r", "record": "CVE-2026-110644", "field": "creation_timestamp", "uuid": "d814dda6-3e4d-4e9e-8938-b60fc457f1e8", "content": "CVE-2026-110644 - nodejs-whisper\nThe nodejs-whisper library (versions up to 0.3.1) can be tricked into executing commands on the server when it processes a crafted audio filename. If an attacker can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nodejswhisper #chetanxpro #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtywmhx242r"}, {"timestamp": "2026-10-14T17:35:33.817Z", "date_only": false, "value": "2026-10-14T17:35:33.817328Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110644", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T17:35:33.817Z", "date_only": false, "value": "2026-10-14T17:35:33.817328Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110644", "record": "FKIE_CVE-2026-110644", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T17:35:48.971Z", "date_only": false, "value": "2026-10-14T17:35:48.971Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110644", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T17:35:48.971Z", "date_only": false, "value": "2026-10-14T17:35:48.971Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-110644", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:44:51.943Z", "date_only": false, "value": "2026-10-14T19:44:51.943941Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440976736724060", "record": "CVE-2026-110644", "field": "creation_timestamp", "uuid": "120e84c6-1b77-4ee6-958a-69c3849b41f3", "content": "CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110644https://github.com/ChetanXpro/nodejs-whisper/pull/259https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77https://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype#ChetanXpro #nodejs-whisper#CVE_2026_110644#bot", "url": "https://infosec.exchange/users/cve/statuses/117440976736724060"}, {"timestamp": "2026-10-16T19:18:44.867Z", "date_only": false, "value": "2026-10-16T19:18:44.867", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110644", "record": "FKIE_CVE-2026-110644", "field": "lastModified"}]}