CPE
Video-stitch versions prior to 2.0.0-beta.1 contain an OS command injection vulnerability allowing attackers to achieve remote code execution by injecting shell metacharacters into file name parameters processed by ffmpeg.