The flaw is an OS command injection in the transcribeAudio function of transcribe2texts. An attacker who supplies a crafted audioPath value can cause the underlying child_process.exec call to interpret shell substitutions such as $() or backticks, or to terminate the quoted string and inject arbitrary commands. Executing these commands runs with the privileges of the Node.js process, enabling full control over the host system, including theft of data, modification of files, or service disruption.

The vulnerability is present in the kky‑ykk transcribe2texts package up to and including version 1.0.6. No other affected versions or patches are listed. Users of this package should check the vendor’s repository for a newer release that addresses the issue.

The CVSS score of 9.3 indicates a high severity of remote code execution. The EPSS score of 3% suggests a low but non-zero likelihood of exploitation, and the lack of a KEV listing indicates it is not currently actively exploited in the field. The likely attack vector is remote if the transcribeAudio interface is exposed to the internet or an internal network; local exploitation would also be effective if the process runs with elevated privileges. Because the flaw permits arbitrary command execution without authentication checks, the risk for compromised accounts or systems is significant.