Whisperx Rest Api
Approved changes feed: RSS · Atom
cpe:2.3:a:pavelzbornik:whisperx_rest_api:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pavelzbornik (734c6acb-6831-57f0-a64d-1ca679490e6e) |
|---|---|
| Product | Whisperx Rest Api (82670973-7c2d-5716-862d-8b7d52a42394) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-34981 |
vulnerable | 2026-06-08 07:59:13.393291 |
whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3
MEDIUM (5.8)
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
Published: 2026-04-06T16:19:13.887Z
Updated: 2026-04-06T18:45:41.844Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.