Executive brief
transcribe-anything is an open-source audio transcription tool that accepts local files or remote URLs as input. A flaw in the URL handling for downloading audio from remote sources allows an attacker to inject arbitrary operating system commands that execute with the privileges of the transcription process, potentially compromising the server or system running the application.
Technical details
The vulnerability is an OS command injection (CWE-78) in the ytdlp_download() function in src/transcribe_anything/ytldp_download.py. The function constructs a shell command by interpolating a user-supplied URL into an f-string without any escaping or validation, then executes it via subprocess.run() with shell=True. An attacker can embed shell metacharacters (such as $(...), backticks, semicolons, pipes, or ampersands) in a URL passed to the public transcribe() API or CLI to break out of the yt-dlp invocation and execute arbitrary commands. The vulnerability is remotely reachable if the application exposes a URL-transcription endpoint that forwards user-supplied URLs to the vulnerable function, though there is no default network listener. The fix is to pass an argument list with shell=False instead of building a shell string.
Affected products
- zackees transcribe-anything up to 4.1.0
Timeline
- 2026-07-11: disclosed: Coordinated disclosure via GitHub issue #137
- 2026-08-25: advisory: CVE-2026-79792 published