CVE-2026-79535CWE-78command-injection

CVE-2026-79535

Medium · published September 30, 2026

CVSS v3.1
6.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-30T00:17Z
References (3)
https://github.com/mbailey/voicemode/commit/c1cef85333fca497c46a11950911d10123f61e48 · [email protected]https://github.com/mbailey/voicemode/releases/tag/v8.10.2 · [email protected]https://www.traceforce.ai/security-advisories/cve-2026-79535 · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 1%
    epss
  • 29 SEP 00:00Z
    mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection
    cvelistv5