by Kastro
Paper/Archive/CVE-2026-110645

CVE-2026-110645

ArsalanDotMe video-stitch — Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.3.883 × 2017.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.

Affected

ProductAffectedFixed inSource
video-stitch< 2.0.0-beta.12.0.0-beta.1CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/ArsalanDotMe/VideoStitch/pull/26patchgithub.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9bwriteupgithub.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61writeupgithub.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99refgithub.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1writeupvulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cut