Whisper-node through 1.1.1 is vulnerable to OS command injection because the createCppCommand function concatenates the filePath and whisperOptions.language parameters directly into a shell command that is executed by shelljs exec. This allows an attacker to embed shell metacharacters or $() substitution and have arbitrary commands executed with the same privileges as the Node.js process. The exploit could lead to full compromise of the host system.

Affected vendor: ariym. Product: whisper-node, version 1.1.1 and prior. Any deployment using that library without a newer release or other mitigations is vulnerable.

The CVSS score of 9.3 indicates critical severity. The EPSS score of 3% suggests a low but nonzero likelihood of exploitation, yet the use of shelljs exec raises a high risk. The likely attack vector is through any interface that allows an attacker to set filePath or language, such as unauthenticated or authenticated APIs that expose the whisper() function. Based on the description, it is inferred that an attacker could trigger the injection by sending crafted parameters to the API, resulting in a remote command execution with Node.js process privileges.