RCE in Ariym Whisper-Node
CVE-2026-110640
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
Vulnerability class: Command Injection (OS Command Injection)
Published .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/ariym/whisper-node/pull/64 (issue-tracking, patch)
- github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src… (technical-description)
- github.com/ariym/whisper-node/blob/c72944cfa48f5c74662ff17ee2dc1d5f7624393e/src… (technical-description)
- unpkg.com/whisper-node@1.1.1/dist/index.js (technical-description)
- www.vulncheck.com/advisories/whisper-node-through-1.1.1-os-command-injection-vi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-110640?
- CVE-2026-110640 is a critical-severity vulnerability in Ariym Whisper-Node, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-10-14.
- How severe is CVE-2026-110640?
- Critical severity. CVSS v3 base score is 9.8 out of 10.