CVE-2026-2629

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2629
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2629.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2629
Published
2026-02-17T22:02:07Z
Modified
2026-10-28T02:30:42Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection
Details

A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2629.json"
}
References

Affected packages

Git / github.com/jishi/node-sonos-http-api

Affected ranges

Type
GIT
Repo
https://github.com/jishi/node-sonos-http-api
Events
Introduced
3776f0ee2261c924c7b7204de121a38100a08ca7
Last Affected
3776f0ee2261c924c7b7204de121a38100a08ca7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3776f0ee2261c924c7b7204de121a38100a08ca7"
                },
                {
                    "last_affected":  "3776f0ee2261c924c7b7204de121a38100a08ca7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

Other
3776f0ee2261c924c7b7204de121a38100a08ca7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2629.json"