Security Advisory

CVE-2026-79535 : OS command injection in mbailey/voicemode update_config

Severity

Medium

CVSS 3.1

6.3

Published

September 22, 2026

Back to advisories

Table of Contents

Advisory details

Product:

VoiceMode (github.com/mbailey/voicemode)

Affected versions:

v8.10.1 and earlier

Patched version:

v8.10.2 (commit c1cef85)

CVSS 3.1 vector:

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE:

CWE-78 OS Command Injection

Publication status:

Pending publication on CVE.org

Summary

update_config writes unescaped values into voicemode.env, which the start scripts source with bash. A crafted value runs as a command on the next service start.

Where the bug is

Tool: update_config, also exposed as the CLI command voicemode config set
Writer: _format_env_value() and update_config() in voice_mode/tools/configuration_management.py; the CLI path in voice_mode/cli.py
File written: ~/.voicemode/voicemode.env
Where it runs: the start scripts start-whisper-server.sh and start-voicemode-serve.sh, which source the env file under bash. These are the systemd ExecStart and launchd program arguments.

How it works

update_config checks the configuration key but quotes the value incompletely. It wraps the value in double quotes and escapes only the double-quote character. Command substitution and backticks pass through unchanged, and a value with no space or quote is written with no quotes at all. Bash performs command substitution even inside double quotes, so when a start script sources the file, a stored value that contains a substitution runs as a command. That happens the next time the whisper or serve service starts, or on reboot, as the user who runs the service.

Exploitation requires access to update_config or the corresponding CLI command. The injected value executes when a VoiceMode start script subsequently sources the environment file. The pattern is the same as CVE-2026-26189 (Trivy Action): input written to an env file unescaped, then sourced.

Impact

Command execution on the host that runs the VoiceMode service, with the privileges of the account that starts it. From there an attacker can read local secrets, change files, or set up persistence.

How to fix it

Upgrade to v8.10.2 or later. The fix shell-escapes values written to voicemode.env, so stored configuration can no longer be read as shell code when the file is sourced.
If upgrading is not yet possible, do not expose the configuration tools, and treat voicemode.env as attacker-influenced until the upgrade is done.
The stronger long-term fix is to load configuration through a systemd EnvironmentFile=, or to parse KEY=VALUE lines in the start scripts without source, and to limit update_config to a known set of keys with validated values.