{"vulnerability": "CVE-2026-110644", "sightings": [{"uuid": "106cd7b5-d0fb-41f1-8e45-4d7a425e7af5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110644", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxtwol7qxh2o", "content": "\ud83d\udea8 CVE-2026-110644 \u2014 CVSS 9.3 CRITICAL\n\nnodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allo...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-110644\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-14T16:09:49.562194Z"}, {"uuid": "d814dda6-3e4d-4e9e-8938-b60fc457f1e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110644", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtywmhx242r", "content": "CVE-2026-110644 - nodejs-whisper\nThe nodejs-whisper library (versions up to 0.3.1) can be tricked into executing commands on the server when it processes a crafted audio filename. If an attacker can\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nodejswhisper #chetanxpro #CVE #infosec", "creation_timestamp": "2026-10-14T16:50:06.814410Z"}, {"uuid": "120e84c6-1b77-4ee6-958a-69c3849b41f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110644", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117440976736724060", "content": "CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110644https://github.com/ChetanXpro/nodejs-whisper/pull/259https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L58-L59https://github.com/ChetanXpro/nodejs-whisper/blob/v0.3.1/src/utils.ts#L76-L77https://www.vulncheck.com/advisories/nodejs-whisper-through-0.3.1-os-command-injection-via-converttowavtype#ChetanXpro #nodejs-whisper#CVE_2026_110644#bot", "creation_timestamp": "2026-10-14T19:44:51.943941Z"}]}