mcp-ffmpeg: OS command injection via shell metacharacters (CVE-2026-117568)
The mcp-ffmpeg package through 1.0.5 contains an OS command injection vulnerability in the resize-video, extract-audio, and get-video-info tools.
CVE search metadata
CVE search record: CVE-2026-117568. Severity: high. CVSS: 7.0. KEV: no. Product: mcp-ffmpeg (<= 1.0.5). Brief: mcp-ffmpeg: OS command injection via shell metacharacters (CVE-2026-117568). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mcp-ffmpeg-rce/
Triage facts
Revision 1- Applicability
- mcp-ffmpeg (<= 1.0.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 15:50 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability. Attackers can supply crafted videoPath or outputDir values to the resize-video, extract-audio, and get-video-info tools. By embedding $(), backticks, or a closing double quote in an existing file or directory name, an attacker can break out of the child_process.exec command string to execute commands as the MCP server user.
Impact
Successful exploitation allows the execution of commands as the MCP server user.