Cpe:2.3:a:video-Stitch:video-Stitch:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3avideo-stitchvideo-stitch/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 14 Oct 2026 16:34:03 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-110645 OS Command Injection in Video-stitchhttps://feed.craftedsignal.io/briefs/2026-10-video-stitch-command-injection/Wed, 14 Oct 2026 16:34:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-video-stitch-command-injection/Video-stitch versions prior to 2.0.0-beta.1 contain an OS command injection vulnerability allowing attackers to achieve remote code execution by injecting shell metacharacters into file name parameters processed by ffmpeg.Video-stitch before version 2.0.0-beta.1 is vulnerable to an OS command injection flaw arising from insecure handling of input parameters. The vulnerability occurs because file names are interpolated directly into shell-executed ffmpeg command lines without proper quoting or sanitization. An attacker who can influence the input provided to the concat(), cut(), or merge() functions in the application can inject arbitrary shell metacharacters. This flaw allows the execution of operating system commands with the permissions of the underlying Node.js process. This vulnerability is highly critical as it provides a direct path for remote code execution (RCE) in any environment using affected versions of Video-stitch to process user-supplied media files.

Impact

Successful exploitation allows for full system command execution under the context of the Node.js process. This may lead to complete compromise of the hosting server, unauthorized access to sensitive files, or further lateral movement within the network. The scope of impact is limited to applications integrating the vulnerable Video-stitch library.

Recommendation

  • Upgrade the Video-stitch library to version 2.0.0-beta.1 or later immediately.
  • Implement strict input validation and sanitization for all file names or parameters passed to the concat(), cut(), and merge() functions within the application layer.
  • Apply the principle of least privilege to the service account running the Node.js application to limit the potential impact of a successful command injection.
]]>criticaladvisoryvulnerabilityrcecommand-injection