CVE-2026-79535

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection

Risk score: 46/100
CVSS: 6.3 v3.1
Exploit chance (30 days): 0.5%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.3 medium

References

https://github.com/mbailey/voicemode/commit/c1cef85333fca497c46a11950911d10123f61e48
https://github.com/mbailey/voicemode/releases/tag/v8.10.2
https://www.traceforce.ai/security-advisories/cve-2026-79535

Original description

mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.

Last activity 29 Sep 2026. Patch Forecast updates every hour.