Remotion EUVD-2026-36744

The attacker must be able to reach a Remotion v4.0.409 instance over the network and reach the code path that performs the file write - based on CVSS PR:N/UI:N this requires no authentication and no user interaction, and AC:L indicates no special timing or environment is needed. Limiting factors not contradicted by the data: the public description does not name the specific Remotion feature (render API, studio server, bundler, or Lambda handler) that contains the sink, so exploitation realistically requires that the affected surface actually be exposed to the attacker - many Remotion deployments are build-time only and would not be reachable over the network. Verify with the linked GitHub advisory which exact endpoint or function is vulnerable before assuming default-config exposure.

The signals diverge sharply: CVSS 9.1 reflects an unauthenticated network-reachable write with high integrity and availability impact, but EPSS (0.15%, 4th percentile) and the absence of any KEV listing or public PoC suggest real-world exploitation is unlikely in the short term. The CVSS AV:N/PR:N rating implies the vulnerable surface is exposed over a network without authentication - however, Remotion is most commonly used as a build-time/server-side renderer rather than a public network service, so AV:N may overstate real exposure for many deployments and should be verified against how the vulnerable code path is actually reached (e.g., Remotion Lambda, the studio server, or render APIs). Confidentiality is rated N, consistent with a pure write primitive, but arbitrary file write on a Node host commonly escalates to RCE by overwriting .js, package.json, or systemd/service files, so the I:H/A:H rating is defensible. Treat this as a high-priority patch for any deployment that exposes Remotion's render service to untrusted input, and lower priority for build-pipeline-only usage.

An attacker reaches a network-exposed Remotion render endpoint (for example a self-hosted Remotion server, studio, or Lambda-style render API) and submits a render request whose output path or asset filename contains a traversal sequence or absolute path, causing Remotion to write attacker-controlled bytes to a sensitive location such as a Node startup script, cron file, or systemd unit. On the next process restart the planted file executes, converting the file-write primitive into code execution on the host. No public exploit is identified at time of analysis, but the CVSS AC:L rating indicates the attack does not require unusual conditions once the vulnerable endpoint is reachable.