AIKIDO-2026-10251
sherpa_onnx is vulnerable to Command Injection
43
Medium Risk
This Affects:
sherpa_onnxTL;DR
Affected versions of this package are vulnerable to command injection. In cmake/cmake_extension.py, build commands are constructed using user-controlled arguments and executed via os.system(), allowing shell metacharacters to be interpreted. This can allow attackers to execute arbitrary commands during the build process. The issue is fixed by switching to subprocess.run() with argument lists and shell=False, preventing command injection.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
sherpa_onnx is vulnerable to Command Injection in versions 0.0.1 - 1.12.23.
How to fix this
Upgrade the sherpa_onnx library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant