CVE-2026-78430: sworddut mcp-ffmpeg-helper Tool handlers.ts handleToolCall os command injection
A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Exploitation requires local access and low privileges. Systems running the affected sworddut mcp-ffmpeg-helper versions 0.1.0, 0.1.1, or 0.2.1 are exposed where an attacker can influence the format argument handled by handleToolCall.
What does an attacker need to exploit this issue?
An attacker needs local access, low-level privileges, and the ability to manipulate the format argument passed to the Tool Handler's handleToolCall function. A public exploit is reported to exist.
Is a fix available?
The available information does not identify a fixed version or patch. The project was reportedly notified through an issue report but had not responded at the time of publication.