Executive brief
picotts is a Node.js wrapper for the PicoTTS text-to-speech engine. An attacker who controls the input to the say function can execute arbitrary commands on the system, potentially leading to full system compromise, data theft, or service disruption.
Technical details
This is a command injection vulnerability (CWE-77) in the picotts Node.js library up through version 0.1.1. The vulnerability exists in the say() function, which uses Node.js child_process.exec() to invoke the underlying PicoTTS binary without sanitizing user-supplied input. An unauthenticated attacker with network access to an application using this library can pass arbitrary shell commands that will be executed with the privileges of the Node.js process. No authentication or user interaction is required. There is no public patch; users should upgrade to a patched version or replace the library with an alternative.
Affected products
- picotts picotts 0.1.1 and earlier
Timeline
- 2021-04-18: disclosed
- 2021-05-07: advisory