CVE-2026-110645: Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
What conditions make an application exploitable?
An application is exposed if an attacker can influence file names supplied to the concat(), cut(), or merge() functions. The vulnerable code interpolates those names without quoting into shell-executed ffmpeg command lines, so shell metacharacters can inject commands.
What level of access does an attacker need?
No privileges or user interaction are required according to the supplied severity vector. Exploitation depends on the attacker being able to control a file name that the application passes to one of the affected functions.
What privileges would injected commands receive?
Injected commands run with the privileges of the Node.js process executing Video-stitch. The impact therefore depends on the operating-system permissions assigned to that process.
Which versions are affected?
Versions before 2.0.0-beta.1 are affected. Upgrade to 2.0.0-beta.1 or later where possible.
What can be done if an upgrade is not immediately possible?
Prevent untrusted input from controlling file names passed to concat(), cut(), or merge(), and reject or safely handle shell metacharacters in such names. Run the Node.js process with minimal operating-system privileges to limit the impact if command injection occurs.