CVE-2026-110645

Summary

This vulnerability allows attackers to inject OS commands through unquoted file names passed to ffmpeg processes, enabling arbitrary command execution with Node.js process privileges. The flaw is particularly dangerous because it can be exploited remotely without authentication.

Exploitability

Exploitation is straightforward with minimal preconditions - attackers need only provide specially crafted file names that contain shell metacharacters to the concat(), cut(), or merge() functions, which are then interpolated unquoted into shell commands.

Blast radius

The impact could be severe across all systems using Video-stitch versions before 2.0.0-beta.1, potentially allowing attackers to execute arbitrary commands on the host system with the privileges of the Node.js process, leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Video-stitch 2.0.0-beta.1 or later to remediate this OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.