Mcp-Ffmpeg (<= 1.0.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mcp-ffmpeg--1.0.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 15:50:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgmcp-ffmpeg: OS command injection via shell metacharacters (CVE-2026-117568)https://feed.craftedsignal.io/briefs/2026-10-mcp-ffmpeg-rce/Tue, 27 Oct 2026 15:50:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mcp-ffmpeg-rce/The mcp-ffmpeg package through 1.0.5 contains an OS command injection vulnerability in the resize-video, extract-audio, and get-video-info tools.mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability. Attackers can supply crafted videoPath or outputDir values to the resize-video, extract-audio, and get-video-info tools. By embedding $(), backticks, or a closing double quote in an existing file or directory name, an attacker can break out of the child_process.exec command string to execute commands as the MCP server user.

Impact

Successful exploitation allows the execution of commands as the MCP server user.

]]>highadvisory