nodejs‑whisper up to version 0.3.1 is vulnerable to OS command injection in the convertToWavType() function. The library constructs a ffmpeg command by passing a user‑provided audio file path directly to shelljs exec(). Attackers can craft file names containing shell metacharacters such as $() for command substitution or embedded quotes, which the shell expands and executes. This allows execution of arbitrary operating‑system commands with the privileges of the Node.js process, resulting in a full compromise of the host. The weakness is a classic example of CWE‑78, unchecked command injection.

The affected product is nodejs‑whisper from the ChetanXpro vendor. Versions up to and including 0.3.1 are impacted. No older or newer releases are listed as affected in the available data.

The CVSS score of 9.3 indicates a high severity with wide impact on confidentiality, integrity, and availability. The EPSS score of 0.02727 (≈2.7%) suggests a low but non‑zero likelihood of exploitation, meaning attackers may successfully exploit the flaw if they control the audio file path input. The vulnerability is not listed in the CISA KEV catalog, but the remote nature of the flaw combined with the high CVSS score warrants urgent attention. Attackers would need to supply a crafted audio file path to a running instance of nodejs‑whisper; if the application is exposed to untrusted input, the exploitation window expands considerably.