Sadtalker
Monthly
Remote code execution in OpenTalker SadTalker allows attackers to run arbitrary OS commands by supplying audio files whose names contain shell metacharacters, which are interpolated unescaped into ffmpeg command lines during video muxing (CWE-78). Any deployment that accepts attacker-influenced audio uploads and then generates video is affected; the flaw was reported by VulnCheck with an accompanying advisory, though no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 base score of 9.3 reflects unauthenticated network-triggerable full-system compromise.
Remote code execution in OpenTalker SadTalker allows attackers to run arbitrary OS commands by supplying audio files whose names contain shell metacharacters, which are interpolated unescaped into ffmpeg command lines during video muxing (CWE-78). Any deployment that accepts attacker-influenced audio uploads and then generates video is affected; the flaw was reported by VulnCheck with an accompanying advisory, though no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 base score of 9.3 reflects unauthenticated network-triggerable full-system compromise.