CVE-2026-110645

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote attackers can execute arbitrary commands with the privileges of the Node.js application process. They only need to supply crafted filenames containing shell metacharacters to an endpoint processing video cuts, concatenations, or merges.

Root cause

User-supplied file names are interpolated unquoted directly into shell-executed ffmpeg command lines inside concat(), cut(), and merge().

Affected systems

video-stitch before 2.0.0-beta.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade video-stitch to version 2.0.0-beta.1 or later. If upgrading is delayed, sanitize filenames to strip shell metacharacters or avoid passing untrusted input directly to concat(), cut(), or merge().

shell

$ npm install video-stitch@2.0.0-beta.1

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110645