Video Stitch
Monthly
OS command injection in the Video-stitch Node.js library (ArsalanDotMe) before 2.0.0-beta.1 allows unauthenticated remote attackers to run arbitrary shell commands with the privileges of the Node.js process by supplying file names containing shell metacharacters to the concat(), cut(), or merge() functions. The vulnerable code interpolated those values unquoted into shell-executed ffmpeg command lines (shelljs.exec) in lib/videoconcat.js and lib/videocut.js, so exposure is realized whenever an embedding application routes untrusted data into the output/clip name or fileName parameters; applications that only pass trusted, internally generated file names are not exploitable. CVSS 4.0 rates this 9.3 (Critical) with PR:N and UI:N, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 2.0.0-beta.1.
OS command injection in the Video-stitch Node.js library (ArsalanDotMe) before 2.0.0-beta.1 allows unauthenticated remote attackers to run arbitrary shell commands with the privileges of the Node.js process by supplying file names containing shell metacharacters to the concat(), cut(), or merge() functions. The vulnerable code interpolated those values unquoted into shell-executed ffmpeg command lines (shelljs.exec) in lib/videoconcat.js and lib/videocut.js, so exposure is realized whenever an embedding application routes untrusted data into the output/clip name or fileName parameters; applications that only pass trusted, internally generated file names are not exploitable. CVSS 4.0 rates this 9.3 (Critical) with PR:N and UI:N, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 2.0.0-beta.1.