Description

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:17.790Z",
  "pubdate": "2026-10-14T15:17:17.790Z",
  "executiveSummary": "The transcribe2texts package, up to and including version 1.0.6, is susceptible to an OS command injection vulnerability. This flaw arises from the improper sanitization of user-supplied input when interacting with the underlying system shell. An attacker can exploit this by crafting malicious audioPath strings provided to the transcribeAudio() function.\nBy leveraging shell metacharacters such as command substitution ($() or backticks) or closing quotes, an attacker can escape the intended command context and execute arbitrary system commands. The injected commands are executed with the same privileges as the Node.js process, which may lead to full system compromise, unauthorized data access, or the deployment of persistent malicious payloads. This vulnerability represents a critical security risk for applications integrating transcribe2texts, as it enables remote code execution (RCE) without requiring specialized authentication. Successful exploitation depends solely on the ability of an attacker to influence the input parameters passed to the vulnerable function.",
  "technicalDetails": "The root cause of this vulnerability is the use of the child_process.exec() function within the transcribeAudio() method without adequate input validation or parameter sanitization. In Node.js, child_process.exec() spawns a shell to execute a provided string command, which makes it inherently sensitive to shell metacharacter injection if the command string is constructed using unsanitized user input.\nThe vulnerability resides specifically in the handling of the audioPath parameter. When this parameter is concatenated into a command string for shell execution, the application fails to neutralize special characters such as '$(', '`', ';', '||', or '&'. An attacker can supply a crafted audioPath that terminates the intended command prematurely and appends arbitrary shell commands.\nFor example, by injecting a payload like 'filename.wav\"; malicious_command; #', the attacker can break out of the intended file path string and force the system to execute 'malicious_command'. Similarly, the use of command substitution operators allows the attacker to embed sub-commands that are evaluated and executed by the shell before the primary command is completed.\nThe attack flow proceeds as follows: 1) The attacker identifies an interface or application endpoint that calls the transcribeAudio() function within the transcribe2texts package. 2) The attacker crafts a malicious input string for the audioPath parameter containing shell-breaking characters and the intended payload. 3) The application passes this unsanitized string to the vulnerable function. 4) The transcribeAudio() function executes the concatenated string via child_process.exec(). 5) The underlying operating system shell interprets the injected characters, executing the attacker's command with the privileges of the Node.js runtime process.\nThe impact of a successful exploit is significant, as it grants the attacker the ability to execute arbitrary code within the host operating system. Depending on the environment's configuration, this could facilitate unauthorized file system access, lateral movement within the network, or the escalation of privileges. The vulnerability affects all versions of transcribe2texts up to 1.0.6 and requires no specific authentication, making it a high-risk vector for any environment utilizing this package in a server-side context."
}