CVE-2026-110643
CVE-2026-110643 · transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath
This page contains facts from public vulnerability sources. Check the original advisory before updating.
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
CVSS 9.3 · Critical · EPSS 2.6%
- Published
- Updated
Affected products and versions
transcribe2texts
- Versions
- ≥ 0, ≤ 1.0.6: Affected (semver)
No fix published
Original sources
- https://github.com/kky-ykk/Transcribe2texts/pull/1
- https://github.com/kky-ykk/Transcribe2texts/blob/7e82f96466fed9ccfc40f7b9e370321701b82c32/lib/index.js#L53-L55
- https://www.vulncheck.com/advisories/transcribe2texts-through-1.0.6-os-command-injection-via-transcribeaudio-audiopath
- https://nvd.nist.gov/vuln/detail/CVE-2026-110643