What is the CVSS score of CVE-2026-30120?

CVE-2026-30120 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Remotion are affected by CVE-2026-30120?

Remotion framework version 4.0.409 contains a critical, unauthenticated remote code execution vulnerability that enables attackers to execute arbitrary code without authentication or user interaction…. A patch is available.

How to fix or mitigate CVE-2026-30120?

24 hours: Audit all systems and development environments running Remotion 4.0.409; document network accessibility and data sensitivity of affected applications. 7 days: Isolate all vulnerable instances to internal-only network access behind VPN and multi-factor authentication; alternatively, operationally suspend Remotion services if business impact permits. 30 days: Monitor remotion-dev project and vendor advisories for patched release; deploy upgrade to safe version immediately upon vendor release; conduct forensic review of logs for unauthorized access attempts during exposure window.

Remotion CVE-2026-30120

EUVD-2026-36743 CRITICAL

Code Injection (CWE-94)

2026-06-15 mitre

GHSA-2jqp-f4gr-44fr

RCE Code Injection N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable code injection is plausible when Remotion is exposed as a render backend, but AC:H reflects that typical deployments do not expose unauthenticated render input; full CIA impact for RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:27 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

28 npm packages depend on remotion (27 direct, 8 indirect)

Ecosystem-wide dependent count for version 4.0.410.

DescriptionCVE.org

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.

AnalysisAI

Remote code execution affects remotion-dev's Remotion framework at version 4.0.409, enabling attackers to execute arbitrary code on systems running the affected version per CWE-94 code injection semantics. The CVSS 9.8 vector indicates network-reachable, unauthenticated exploitation without user interaction, though no public exploit identified at time of analysis and EPSS probability remains low at 0.25% (16th percentile). The vulnerability is reported by MITRE with a third-party advisory on GitHub but lacks detailed exploitation specifics.

Technical ContextAI

Remotion is a TypeScript/React-based programmatic video creation framework from remotion-dev used by developers to render videos using web technologies, often invoked from Node.js backends or CI pipelines. CWE-94 (Improper Control of Generation of Code, a.k.a. Code Injection) indicates that user-controllable input flows into a code-evaluation or template-rendering context - common Remotion attack surfaces include the rendering pipeline's evaluation of compositions, props passed to renderMedia/renderStill, or server-side bundling routines that may evaluate untrusted inputs. The supplied CPE 'cpe:2.3:a:n/a:n/a' is a placeholder rather than a properly formed product identifier, which complicates automated scanning until the official CPE is published.

RemediationAI

No vendor-released patch identified at time of analysis - the only public reference is a third-party advisory at https://github.com/EaEa0001/security-advisories/blob/main/CVE-2026-30120.md and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-30120, neither of which cites a fixed Remotion release. Until remotion-dev publishes a fixed version, pin to a known-good prior release if regression-tested, avoid passing untrusted user input as Remotion composition props, render parameters, or bundling inputs, and run Remotion renders in an isolated container or sandbox with no network egress and minimal filesystem access to contain potential code execution. If Remotion is exposed via a server-side rendering endpoint, place it behind authenticated access and validate/strictly type all props before they reach renderMedia or selectComposition - the trade-off is reduced flexibility for callers passing dynamic templates.