What is the CVSS score of CVE-2026-30121?

CVE-2026-30121 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Remotion are affected by CVE-2026-30121?

Remotion v4.0.409 contains a critical arbitrary file write vulnerability (CVSS 9.1) that allows unauthenticated remote attackers to write malicious content to the host filesystem.. A patch is available.

Is there a public PoC exploit available for CVE-2026-30121?

Yes, a public proof-of-concept exploit is available for CVE-2026-30121. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-30121?

Within 24 hours: Identify all systems running Remotion v4.0.409 and assess network exposure; restrict network access to Remotion services to trusted sources only. Within 7 days: Implement input validation and filesystem access controls; evaluate alternative video rendering solutions or isolated deployment architectures. Within 30 days: Monitor vendor advisories for patch release; if no patch becomes available, complete migration to verified alternatives or implement comprehensive network segmentation with application-level controls.

Remotion CVE-2026-30121

EUVD-2026-36744 CRITICAL

Write-what-where Condition (CWE-123)

2026-06-15 mitre

GHSA-g6pc-6676-c23j

Information Disclosure N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

9.1 CRITICAL

Arbitrary file write reachable over the network without auth or user interaction per description and CWE-123; no confidentiality impact from a pure write primitive, high integrity and availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:27 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

28 npm packages depend on remotion (27 direct, 8 indirect)

Ecosystem-wide dependent count for version 4.0.410.

DescriptionCVE.org

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.

AnalysisAI

Arbitrary file write in remotion-dev Remotion v4.0.409 allows remote attackers to write attacker-controlled content to arbitrary filesystem locations without authentication, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and CWE-123 (Write-what-where) classification. Remotion is a React-based programmatic video rendering framework, and the flaw can lead to integrity and availability compromise of the host running the rendering engine. No public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates low predicted exploitation likelihood despite the high CVSS score.

Technical ContextAI

Remotion is a JavaScript/Node.js framework from remotion-dev that lets developers build videos using React components and renders them via a headless browser/server pipeline. CWE-123 (Write-what-where Condition) describes a class of bug where an attacker can control both the destination path and the content of a write operation - in a Node/Remotion context this typically arises from unsanitized path inputs flowing into fs.writeFile, output asset paths, or render output destinations that fail to constrain writes to an intended directory (path traversal via '../' or absolute paths). The CPE entry is generic ('cpe:2.3:a:n/a:n/a') so the affected component within Remotion is not enumerated by NVD; the GitHub advisory referenced is the only public source detailing the affected code path.

RemediationAI

No vendor-released patch identified at time of analysis - the supplied data does not name a fixed Remotion release. Defenders should monitor the remotion-dev GitHub repository and the advisory at https://github.com/EaEa0001/security-advisories/blob/main/CVE-2026-30121.md for a patched version above 4.0.409, and upgrade as soon as one is published. As compensating controls, do not expose Remotion's render server or studio to untrusted networks (bind to localhost or place behind authenticated reverse proxy), validate and canonicalize any user-supplied output path or filename before passing it to render APIs and reject paths containing '..' or absolute prefixes, run the Remotion process under a low-privilege OS user with write access only to a dedicated output directory (e.g., via a chroot, container with read-only root filesystem, or AppArmor/SELinux profile), and enable filesystem auditing on the render host to detect writes outside the intended output directory - note the trade-off that strict path validation may break legitimate workflows that rely on dynamic output locations.