CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-110640 — Whisper-node through 1.1.1 contains an OS command injection vulnerability that a...

·Source: NIST NVD

Updated:

Executive Summary

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.

Analysis

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges. CVSS Score: 9.8. Published: 2026-10-14T15:17:17.277.

Indicators of Compromise (1)

CVE (1)
CVE-2026-110640
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 14, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Cognitive Credit raises $40m to scale specialist data and AI for credit markets

Corporate credit data, analytics, and AI technology provider Cognitive Credit has closed a $40 million strategic growth investment led by Summit Partners with participation from ETFS Capital.

Finextra
MEDIUMVulnerability

Quest Diagnostics Reports Hack on IT System Used by Clients

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/quest-diagnostics-reports-hack-on-system-used-by-clients-image_small-9-a-33185.jpg" align=right hspace=4><b>Medical Testing Lab Told SEC Incident Likely Compromised 'Certain Patient Records'</b><br>Medical testing company Quest Diagnostics has told the U.S. Securities and Exchange Commission that it's responding to a cyber inciden

Bank Info Security
MEDIUMVulnerability

Alms For the Cyber Poor: Program Will Help Small Utilities

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/alms-for-cyber-poor-program-will-help-small-utilities-image_small-5-a-33186.jpg" align=right hspace=4><b>Dragos Has Learned That 'Free' Doesn't Always Mean 'Usable'</b><br>Dragos, a pioneer in the operational technology security market, and its new backer, consulting giant Accenture, are teaming up with the Sans Institute training

Bank Info Security