CVE-2026-110645

EUVD-2026-101273
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61
https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99
https://github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9b
https://github.com/ArsalanDotMe/VideoStitch/pull/26
https://github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1
https://www.vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cut
https://github.com/ArsalanDotMe/VideoStitch/pull/26