Mcp Ffmpeg Helper
Monthly
OS command injection in sworddut mcp-ffmpeg-helper affects the handleToolCall function in src/tools/handlers.ts across all three released versions (0.1.0, 0.1.1, 0.2.1), allowing a local low-privilege attacker to execute arbitrary OS commands by manipulating the format argument. Publicly available exploit code exists via a GitHub issue, and the vendor has not responded to the coordinated disclosure, leaving all known versions unpatched. This is not listed in CISA KEV; exploitation requires local access, which substantially limits real-world exposure.
OS command injection in sworddut mcp-ffmpeg-helper affects the handleToolCall function in src/tools/handlers.ts across all three released versions (0.1.0, 0.1.1, 0.2.1), allowing a local low-privilege attacker to execute arbitrary OS commands by manipulating the format argument. Publicly available exploit code exists via a GitHub issue, and the vendor has not responded to the coordinated disclosure, leaving all known versions unpatched. This is not listed in CISA KEV; exploitation requires local access, which substantially limits real-world exposure.