CVE-2026-27897: Wanderingastronomer Vociferous authentication bypass (CVSS 10.0)

Description

Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability exists in src/api/system.py within the export_file route. The application accepts a JSON payload containing a filename and content. While the developer intended for a native UI dialog to handle the file path, the API does not validate the filename string before it is processed by the backends filesystem logic. Because the API is unauthenticated and the CORS configuration in app.py is overly permissive (allow_origins=["*"] or allowing localhost), an external attacker can bypass the UI entirely. By using directory traversal sequences (../), an attacker can force the app to write arbitrary data to any location accessible by the current user's permissions. This vulnerability is fixed in 4.4.2.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Wanderingastronomer Vociferous< 4.4.2

Remediation

Fixed in

Wanderingastronomer Vociferous≥ 4.4.2

Patch & vendor advisories

https://github.com/WanderingAstronomer/Vociferous/security/advisories/GHSA-7cpr-frgj-h85v

References

https://github.com/WanderingAstronomer/Vociferous/security/advisories/GHSA-7cpr-frgj-h85vExploitVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-27897 being actively exploited?

CVE-2026-27897 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.84%.

How severe is CVE-2026-27897?

CVE-2026-27897 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 0.84% probability of exploitation.

Which products are affected by CVE-2026-27897?

Affected products include Wanderingastronomer Vociferous.

How do I fix CVE-2026-27897?

Upgrade affected software to a fixed version, for example Wanderingastronomer Vociferous 4.4.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-27897 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo