CVE-2026-2629 is an OS command injection vulnerability found in the Promise function within the lib/tts-providers/mac-os.js component of jishi node-sonos-http-api, affecting versions up to 3776f0ee2261c924c7b7204de121a38100a08ca7. This flaw allows remote attackers to execute arbitrary commands by manipulating the 'phrase' argument. The vulnerability carries a CVSS v3.1 score of 7.3 (HIGH), indicating a severe risk due to its network-based attack vector, low attack complexity, and no required user interaction, potentially leading to low impacts on confidentiality, integrity, and availability. While exploit code has been made publicly available, there is currently no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Jishi | Node-Sonos-Http-Api | 3776f0ee2261c924c7b7204de121a38100a08ca7CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.