CVE-2026-34981 Details
Description
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the whisperX API, specifically in the FileService.download_from_url() function. This vulnerability exists in versions 0.3.1 through 0.5.0. The issue arises because the function calls requests.get(url) without any prior validation of the URL. Although there is a file extension check, it occurs after the HTTP request has been made, allowing the extension check to be bypassed by appending .mp3 to internal URLs. The vulnerability is exacerbated by the fact that the /speech-to-text-url endpoint is unauthenticated, making it possible for an attacker to exploit this issue remotely.
Users can update to whisperX version 0.6.0 or later, where this vulnerability has been fixed. The update includes added validation for URLs before making HTTP requests, ensuring that only safe URLs are processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pavelzbornik/whisperX-FastAPI/commit/ef78fe2001deede5354031e4200d41c6a7e8cbfc | [email protected] | Patch |
| https://github.com/pavelzbornik/whisperX-FastAPI/issues/256 | [email protected] | Issue TrackingPatch |
| https://github.com/pavelzbornik/whisperX-FastAPI/security/advisories/GHSA-6rc7-r867-c635 | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pavelzbornik whisperx rest api | >= 0.3.1, < 0.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |