CVE-2026-117568: mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the childprocess.exec command string and execute commands as the MCP server user.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
They need to be able to supply videoPath or outputDir values to the resize-video, extract-audio, or get-video-info tools. The crafted value must reference an existing file or directory name containing shell metacharacters such as $(), backticks, or a closing double quote.
What permissions do injected commands receive?
Injected commands run as the MCP server user. The impact therefore depends on the filesystem access and other privileges assigned to that account.
Which tool functionality should be considered exposed?
The affected functionality is resize-video, extract-audio, and get-video-info when they process videoPath or outputDir input. Other tools are not identified in the available information.