CVE-2026-110645 — Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shel…
Published: 2026-10-14 · CVSS: 9.3 · CVSS 4.0
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7