CVE: CVE-2026-2629 CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command Severity: CVSSv3 7.3 Disclosure Date: February 17, 2026 Affected Commit: up to and including 3776f0ee2261c924c7b7204de121a38100a08ca7 Root Cause: The macOS-specific TTS provider directly interpolates the value into a shell command passed to , leading to OS Command Injection. Exploitation: Attacker can inject arbitrary OS commands via the parameter. No authentication is required. Impact: Affected Version: Repository: https://github.com/jishi/node-sonos-http-api Affected through commit: 3776f0ee2261c924c7b7204de121a38100a08ca7 Suggested Fix: Use or instead of for user-influenced input.