{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/video-stitch/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:video-stitch:video-stitch:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110645"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Video-stitch (\u003c 2.0.0-beta.1)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","rce","command-injection"],"_cs_type":"advisory","_cs_vendors":["Video-stitch"],"content_html":"\u003cp\u003eVideo-stitch before version 2.0.0-beta.1 is vulnerable to an OS command injection flaw arising from insecure handling of input parameters. The vulnerability occurs because file names are interpolated directly into shell-executed ffmpeg command lines without proper quoting or sanitization. An attacker who can influence the input provided to the concat(), cut(), or merge() functions in the application can inject arbitrary shell metacharacters. This flaw allows the execution of operating system commands with the permissions of the underlying Node.js process. This vulnerability is highly critical as it provides a direct path for remote code execution (RCE) in any environment using affected versions of Video-stitch to process user-supplied media files.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full system command execution under the context of the Node.js process. This may lead to complete compromise of the hosting server, unauthorized access to sensitive files, or further lateral movement within the network. The scope of impact is limited to applications integrating the vulnerable Video-stitch library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Video-stitch library to version 2.0.0-beta.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all file names or parameters passed to the concat(), cut(), and merge() functions within the application layer.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege to the service account running the Node.js application to limit the potential impact of a successful command injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:34:03Z","date_published":"2026-10-14T16:34:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-video-stitch-command-injection/","summary":"Video-stitch versions prior to 2.0.0-beta.1 contain an OS command injection vulnerability allowing attackers to achieve remote code execution by injecting shell metacharacters into file name parameters processed by ffmpeg.","title":"CVE-2026-110645 OS Command Injection in Video-stitch","url":"https://feed.craftedsignal.io/briefs/2026-10-video-stitch-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Video-Stitch","version":"https://jsonfeed.org/version/1.1"}