CVE-2026-2629: node-sonos-http-api RCE Vulnerability

CVE-2026-2629 Overview

A command injection vulnerability has been identified in jishi node-sonos-http-api, an open-source Node.js application that provides an HTTP API for controlling Sonos speakers. The vulnerability exists in the Text-to-Speech (TTS) Provider component, specifically within the Promise function located in lib/tts-providers/mac-os.js. Improper sanitization of the phrase argument allows remote attackers to inject and execute arbitrary operating system commands on the underlying server.

Critical Impact

Remote attackers can execute arbitrary OS commands on systems running the vulnerable node-sonos-http-api TTS provider, potentially leading to complete system compromise, data theft, or lateral movement within the network.

Affected Products

• jishi node-sonos-http-api (up to commit 3776f0ee2261c924c7b7204de121a38100a08ca7)
• Systems utilizing the macOS TTS Provider component (lib/tts-providers/mac-os.js)
• Deployments with network-accessible node-sonos-http-api endpoints

Discovery Timeline

• 2026-02-17 - CVE-2026-2629 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2629

Vulnerability Analysis

This vulnerability is classified as CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection). The flaw resides in the macOS Text-to-Speech provider module of node-sonos-http-api, where user-supplied input through the phrase argument is passed to system commands without adequate sanitization.

The node-sonos-http-api application provides HTTP endpoints that allow users to interact with Sonos devices, including text-to-speech functionality. When the macOS TTS provider is utilized, the application processes the phrase parameter and executes operating system commands to generate speech audio. The lack of proper input validation on this parameter creates an injection point where an attacker can break out of the intended command context and execute arbitrary commands.

The vulnerability is remotely exploitable with no authentication or user interaction required. Since this is a rolling-release project without versioned releases, affected deployments are those running code up to and including commit 3776f0ee2261c924c7b7204de121a38100a08ca7.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of the phrase argument within the Promise function in lib/tts-providers/mac-os.js. The application passes user-controlled input directly to OS command execution functions without properly escaping or validating special characters that could be interpreted as command separators or operators.

Command injection vulnerabilities commonly occur when applications construct shell commands using string concatenation with untrusted input. Characters such as semicolons (;), backticks (`), pipes (|), and command substitution sequences ($()) can be used to terminate the intended command and inject additional malicious commands.

Attack Vector

The attack vector for CVE-2026-2629 is network-based. An attacker with network access to the node-sonos-http-api HTTP endpoint can craft malicious requests containing specially formatted phrase parameters. These requests are processed by the macOS TTS provider, which executes the injected commands with the privileges of the application process.

Exploitation of this vulnerability can be accomplished by sending HTTP requests to the TTS endpoint with a malicious payload embedded in the phrase parameter. The attacker could inject command separators followed by arbitrary shell commands that would be executed on the target system.

For technical details on the vulnerability, refer to GitHub Issue #915 and the VulDB entry.

Detection Methods for CVE-2026-2629

Indicators of Compromise

• Unusual HTTP requests to TTS endpoints containing shell metacharacters (;, |, &, `, $())
• Unexpected child processes spawned by the Node.js application process
• Anomalous outbound network connections originating from the node-sonos-http-api service
• Suspicious command execution patterns in system logs referencing the application user context

Detection Strategies

• Monitor HTTP request logs for TTS endpoints containing command injection patterns or shell metacharacters in the phrase parameter
• Implement application-layer firewall rules to detect and block requests with potentially malicious payloads targeting known injection patterns
• Enable process execution monitoring on systems running node-sonos-http-api to identify unexpected command executions
• Deploy endpoint detection solutions capable of correlating web application activity with subsequent suspicious process creation

Monitoring Recommendations

• Configure logging for all requests to the node-sonos-http-api service with full request body capture for forensic analysis
• Set up alerts for any system command execution initiated by the Node.js process outside of expected TTS commands
• Monitor network traffic for connections from the application server to unexpected external destinations
• Implement file integrity monitoring on the application directory to detect potential backdoor installation

How to Mitigate CVE-2026-2629

Immediate Actions Required

• Restrict network access to the node-sonos-http-api service to trusted networks or localhost only
• Implement a web application firewall (WAF) or reverse proxy with input validation rules to filter malicious characters
• Consider disabling the macOS TTS provider if not required for your deployment
• Review and audit any systems that have been running the vulnerable application for signs of compromise

Patch Information

As of the last NVD update on 2026-02-18, no official patch has been released for this vulnerability. The project maintainers were notified through GitHub Issue #915 but have not yet responded. Users should monitor the project repository for updates and apply patches as soon as they become available.

Workarounds

• Network isolation: Restrict access to the API endpoint using firewall rules to allow connections only from trusted hosts
• Input filtering: Deploy a reverse proxy (nginx, HAProxy) with request filtering to strip or reject shell metacharacters from TTS requests
• Alternative TTS providers: If available, configure the application to use a different TTS provider that does not execute local shell commands
• Containerization: Run the application in a sandboxed container with minimal privileges and restricted system access

# Example: Restrict access using iptables (Linux) or pfctl (macOS)
# Allow only localhost to access the API on port 5005
iptables -A INPUT -p tcp --dport 5005 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 5005 -j DROP