CVE-2026-2629

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2629", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-17T13:47:54.918Z", "datePublished": "2026-02-17T22:02:07.087Z", "dateUpdated": "2026-02-23T10:16:24.177Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:16:24.177Z"}, "title": "jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "jishi", "product": "node-sonos-http-api", "versions": [{"version": "3776f0ee2261c924c7b7204de121a38100a08ca7", "status": "affected"}], "modules": ["TTS Provider"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-17T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-21T17:40:35.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "XavLimSG (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "XavLimSG (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/?id.346280", "name": "VDB-346280 | jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346280", "name": "VDB-346280 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.752762", "name": "Submit #752762 | jishi node-sonos-http-api 3776f0e (Mar 22, 2025) OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jishi/node-sonos-http-api/issues/915", "tags": ["issue-tracking"]}, {"url": "https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-2629/CVE-2026-2629.md", "tags": ["exploit"]}, {"url": "https://github.com/jishi/node-sonos-http-api/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-18T20:43:20.322525Z", "id": "CVE-2026-2629", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:43:27.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2629", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-18T20:43:20.322525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-18T20:43:24.404Z"}}], "cna": {"title": "jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "XavLimSG (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "XavLimSG (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "jishi", "modules": ["TTS Provider"], "product": "node-sonos-http-api", "versions": [{"status": "affected", "version": "3776f0ee2261c924c7b7204de121a38100a08ca7"}]}], "timeline": [{"lang": "en", "time": "2026-02-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-17T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-21T17:40:35.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.346280", "name": "VDB-346280 | jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.346280", "name": "VDB-346280 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.752762", "name": "Submit #752762 | jishi node-sonos-http-api 3776f0e (Mar 22, 2025) OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/jishi/node-sonos-http-api/issues/915", "tags": ["issue-tracking"]}, {"url": "https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-2629/CVE-2026-2629.md", "tags": ["exploit"]}, {"url": "https://github.com/jishi/node-sonos-http-api/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T10:16:24.177Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2629", "state": "PUBLISHED", "dateUpdated": "2026-02-23T10:16:24.177Z", "dateReserved": "2026-02-17T13:47:54.918Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-17T22:02:07.087Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["TTS Provider"], "product": "node-sonos-http-api", "vendor": "jishi", "versions": [{"status": "affected", "version": "3776f0ee2261c924c7b7204de121a38100a08ca7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en jishi node-sonos-http-api hasta 3776f0ee2261c924c7b7204de121a38100a08ca7. Afecta a la funci\u00f3n Promise del archivo lib/tts-providers/mac-os.js del componente TTS Provider. Esta manipulaci\u00f3n del argumento phrase provoca inyecci\u00f3n de comandos del sistema operativo. Es posible iniciar el ataque en remoto. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. Este producto realiza lanzamientos continuos para proporcionar una entrega continua. Por lo tanto, no se dispone de detalles de versi\u00f3n para las versiones afectadas ni actualizadas. El proyecto fue informado pronto del problema a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."}], "id": "CVE-2026-2629", "lastModified": "2026-06-17T10:31:25.793", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2629", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-18T20:43:20.322525Z", "version": "2.0.3"}}]}, "published": "2026-02-17T22:18:45.653", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/XavLimSG/Vulnerability-Research/blob/main/CVE-2026-2629/CVE-2026-2629.md"}, {"source": "cna@vuldb.com", "url": "https://github.com/jishi/node-sonos-http-api/"}, {"source": "cna@vuldb.com", "url": "https://github.com/jishi/node-sonos-http-api/issues/915"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.346280"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.346280"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.752762"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3776f0ee2261c924c7b7204de121a38100a08ca7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "node-sonos-http-api", "source": "cna", "vendor": "jishi"}, "product": "node-sonos-http-api", "vendor": "jishi"}], "created": "2026-02-18T10:33:07.925772+00:00", "updated": "2026-06-18T11:00:04.237307+00:00", "vendors": ["jishi", "jishi$PRODUCT$node-sonos-http-api"]}