CVE-2026-110643
CVE-2026-110643 · transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
CVSS 9.3 · Crítica · EPSS 2,6%
- Publicación
- Actualización
Productos y versiones afectados
transcribe2texts
- Versiones
- ≥ 0, ≤ 1.0.6: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/kky-ykk/Transcribe2texts/pull/1
- https://github.com/kky-ykk/Transcribe2texts/blob/7e82f96466fed9ccfc40f7b9e370321701b82c32/lib/index.js#L53-L55
- https://www.vulncheck.com/advisories/transcribe2texts-through-1.0.6-os-command-injection-via-transcribeaudio-audiopath
- https://nvd.nist.gov/vuln/detail/CVE-2026-110643