nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.02727·Published 2026-10-14·Fixed in 0.4.0CWE-78