{"id":"CVE-2026-110645","published":"2026-10-14T15:17:18.090","lastModified":"2026-10-15T14:47:05.720","description":"Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9b","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/pull/26","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1","tags":[]},{"url":"https://www.vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cut","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/pull/26","tags":[]}],"exploitRefs":[{"url":"https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9b","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/pull/26","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1","tags":[]},{"url":"https://github.com/ArsalanDotMe/VideoStitch/pull/26","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows attackers to inject OS commands through unquoted file names passed to ffmpeg processes, enabling arbitrary command execution with Node.js process privileges. The flaw is particularly dangerous because it can be exploited remotely without authentication.","exploitability":"Exploitation is straightforward with minimal preconditions - attackers need only provide specially crafted file names that contain shell metacharacters to the concat(), cut(), or merge() functions, which are then interpolated unquoted into shell commands.","blast_radius":"The impact could be severe across all systems using Video-stitch versions before 2.0.0-beta.1, potentially allowing attackers to execute arbitrary commands on the host system with the privileges of the Node.js process, leading to full system compromise.","remediation":"Upgrade to Video-stitch 2.0.0-beta.1 or later to remediate this OS command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","nodejs","ffmpeg"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:49:35.734Z"}}