VoiceMode versions up to 8.10.1 contain a flaw in the update_config MCP tool and the "voicemode config set" CLI, which writes caller‑supplied values directly to ~/.voicemode/voicemode.env without shell‑safe escaping. The lack of input sanitization allows an attacker to inject arbitrary shell commands that the VoiceMode process will execute. This can lead to full compromise of the underlying operating system, including theft of data, installation of malware, and disruption of service.

The affected product is VoiceMode version 8.10.1 and all earlier releases, regardless of operating system. Users of the update_config MCP tool or the CLI who can supply untrusted input are in scope. No specific vendor or product name is listed; the impact applies to any installation of VoiceMode prior to the 8.10.2 release.

The CVSS score of 6.3 reflects a moderate‑to‑high impact for this OS Command Injection, while the EPSS score of < 1 % indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation at this time. Attackers who can influence the input to the update_config tool—whether through local user actions or a compromised configuration process—could potentially execute arbitrary commands with the privileges of the VoiceMode process. The vulnerability appears local rather than remote unless the tool is exposed to untrusted input over the network.