mcp-ffmpeg CVE-2026-117568

Exploitation requires the attacker to control or influence the videoPath or outputDir arguments passed to the resize-video, extract-audio, or get-video-info tools of mcp-ffmpeg (≤1.0.5), or to cause those tools to operate on an existing file or directory whose name already contains $(), backticks, or a closing double quote. The payload must therefore live inside a path/name that the server forwards to child_process.exec, which is why the CVSS carries AT:P and AC:H rather than a free-form unauthenticated input - the condition is a crafted-but-already-present filesystem name reachable by the tool. Limiting factors: the attack vector is local (AV:L), PR:L indicates the attacker needs some level of access to reach the MCP tool interface, and the affected scope is restricted to mcp-ffmpeg versions up to and including 1.0.5; executed commands run only with the privileges of the MCP server user.

CVSS 4.0 rates this 7.3 (High), but the vector is telling: AV:L (local), AC:H, AT:P (a specific attack requirement must be present), and PR:L - this is not a trivially remote, unauthenticated RCE. The technical impact is high and well-supported by evidence (VC:H/VI:H/VA:H): successful injection executes arbitrary shell commands as the MCP server user, i.e. full compromise of the host account running the server. Against that, the exploitation conditions are constrained: an attacker must influence the videoPath/outputDir inputs to the resize-video, extract-audio or get-video-info tools, or cause the server to process an existing file/directory whose name already carries $(), backticks or a closing double quote - which is precisely what AT:P and AC:H encode here, grounded in the description's 'existing file or directory name' wording. No CISA KEV listing is present and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from this data; absence of EPSS is a genuine gap, not a low score. The vuln.today decision label is 'this_week' (sourced from VulnCheck), consistent with a serious-but-not-emergency priority. Net: a high-impact flaw whose real-world urgency is tempered by a local attack vector, a required privilege level, and a non-trivial precondition - prioritize it where untrusted or attacker-influenced input can reach these MCP tools, but it does not carry the profile of a mass-exploitable internet-facing bug.

An actor who can invoke the MCP server's resize-video, extract-audio or get-video-info tools supplies a videoPath or outputDir containing shell metacharacters such as $(id) or backticks, or causes the server to process a file/directory whose name already embeds them; when the server assembles the ffmpeg command and runs it through child_process.exec, the injected shell command executes as the MCP server user. No public exploit code was identified in the available data, though the CVE description and VulnCheck advisory describe the technique in concrete detail. Because the vector is local with a required precondition, the attacker must already be able to shape those path inputs or plant the maliciously named filesystem entry.