transcribe2texts through version 1.0.6 has a critical OS command injection flaw (CVSS 3.1: 9.8). An attacker who controls the audioPath value passed to transcribeAudio() can run arbitrary commands with the privileges of the Node.js process.
What Is It
CVE-2026-110643 is an OS command injection vulnerability (CWE-78) in transcribe2texts, an npm package maintained by kky-ykk. The transcribeAudio() function passes the audioPath argument to child_process.exec() without escaping it. An attacker can inject commands using $() substitution, backtick substitution, or a closing quote that breaks out of the intended path string.
VulnCheck disclosed the issue. NVD published the record on 2026-10-14, and its status is currently "Received."
Why It Matters
VulnCheck rates the issue critical:
- CVSS 3.1: 9.8 (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Network attack vector, low complexity, no privileges or user interaction needed, and high impact to confidentiality, integrity and availability. - CVSS 4.0: 9.3 (CRITICAL).
Successful exploitation runs commands with the same privileges as the Node.js process. Any application that passes user-influenced file paths to transcribeAudio() is exposed.
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data contains no confirmation of active exploitation.
What's Vulnerable
- Package:
transcribe2texts(pkg:npm/transcribe2texts) - Vendor: kky-ykk
- Repository: github.com/kky-ykk/Transcribe2texts
- Affected versions: all versions from 0 through 1.0.6 (semver)
- Vulnerable code:
lib/index.js, lines 53–55 (at commit7e82f96)
No CPEs are listed in the NVD record.
Patch Status
The supplied NVD data does not name a fixed version. The references include a pull request (#1) on the project repository, but the record does not say whether it was merged or released.
Until a fixed release is confirmed:
- Treat every version through 1.0.6 as vulnerable.
- Do not pass untrusted or user-controlled input as
audioPath. - Check the project repository and the VulnCheck advisory for remediation updates.