CVE-2026-34981
Medium
Description
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
SeverityMedium
CVSS5.8
Exploit probability—
ProductPavelzbornik Whisperx Rest Api
PublishedApr 6, 2026
First seenApr 6, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- pavelzbornik whisperx_rest_api0.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pavelzbornik whisperx_rest_api | 0.3.1 ≤ v < 0.6.0 | 0.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.