Description

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:18.090Z",
  "pubdate": "2026-10-14T15:17:18.090Z",
  "executiveSummary": "Video-stitch versions prior to 2.0.0-beta.1 are susceptible to an OS command injection vulnerability. The flaw originates from the insecure handling of user-supplied input within functions that invoke external shell commands.\nSpecifically, the concat(), cut(), and merge() functions fail to properly sanitize or quote file names before interpolating them into ffmpeg command lines executed via a shell interface. This allows an attacker to break out of the intended command context by injecting arbitrary shell metacharacters.\nThe vulnerability allows for remote or local command execution with the privileges of the Node.js process hosting the application. Successful exploitation could lead to unauthorized system access, data exfiltration, or complete system compromise. No specific authentication is required if the attacker can influence the file name parameters processed by the vulnerable functions. Users are strongly advised to update to version 2.0.0-beta.1 or later to remediate this security risk.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of input validation and command execution patterns within the video-stitch library. The affected functions—concat(), cut(), and merge()—construct command strings by directly concatenating unsanitized, user-provided file path strings into an ffmpeg command line template. This template is subsequently passed to a shell execution function (such as child_process.exec) which interprets shell metacharacters.\nWhen a file name containing shell metacharacters (e.g., ;, &, |, $, or backticks) is passed to these functions, the shell parses these characters as command separators or operators rather than literal components of a file path. Consequently, the attacker can terminate the intended ffmpeg command and append arbitrary OS commands. For instance, an input payload formatted as 'dummy.mp4; touch /tmp/pwned' would result in the execution of the original video processing task followed by the execution of the injected command.\nThe execution occurs within the context and security boundary of the Node.js process. Consequently, the injected payload inherits all OS-level permissions assigned to the Node.js runtime. If the application is running as a privileged user, the attacker gains equivalent access. This type of vulnerability is particularly dangerous in web-based applications where filenames are frequently derived from user-uploaded content or untrusted metadata.\nThe exploitation flow is as follows: 1) The attacker identifies a mechanism where they can influence the file naming parameters processed by the concat(), cut(), or merge() functions. 2) The attacker crafts a malicious file name string embedding shell metacharacters designed to execute arbitrary code. 3) The application processes this input, interpolating it into the shell command string without prior sanitization or escaping. 4) The shell evaluates the injected string, triggering the execution of the malicious payload. This vulnerability exists across all versions of video-stitch prior to 2.0.0-beta.1."
}