OS command injection via incomplete fix in AVideo execAsync() (CVE-2026-64625)

AVideo's patch for CVE-2026-45578 introduced escapeshellarg() per token in plugin/Live/on_publish.php, but the shared helper execAsync() re-embeds the assembled command inside an outer double-quoted sh -c invocation. Within those double quotes, $() command substitution and backticks remain active, allowing attackers to inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite the escapeshellarg() protection. Affected versions: - <=v29.0 We recommend updating to: >= 29.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/WWBN/AVideo/security/advisories/GHSA-rc5x-vh5v-473f Details: https://vuln.today/cve/CVE-2026-64625