Description

A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/tools/handlers.ts of the component Tool Handler. The manipulation of the argument format results in os command injection. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-24T20:17:22.560Z",
  "pubdate": "2026-08-24T20:17:22.560Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in sworddut mcp-ffmpeg-helper versions 0.1.0, 0.1.1, and 0.2.1. The flaw exists within the handleToolCall function inside the src/tools/handlers.ts component, specifically stemming from the unsafe handling and manipulation of the format argument. This security defect allows a threat actor to execute arbitrary operating system commands in the context of the running application.\nThe primary impact of successful exploitation includes full system compromise, unauthorized data access, and execution of arbitrary code on the underlying host operating system. The risk implication is severe, as the exploit has been made public and the project maintainers have failed to respond to early issue reports.\nRegarding attacker capabilities and exploitation requirements, attacking locally is a mandatory prerequisite for successful exploitation. The attacker must possess local access to interact with the vulnerable tool handler interface and supply maliciously crafted input to the format argument.",
  "technicalDetails": "The vulnerability resides in the src/tools/handlers.ts file of the mcp-ffmpeg-helper component, specifically within the handleToolCall function. The root cause of the vulnerability is the improper sanitization, validation, or escaping of input data passed via the format argument before it is concatenated or passed directly into an underlying operating system shell execution sink.\nBecause the application dynamically constructs shell commands using untrusted user-supplied input from the format parameter, an attacker can append shell metacharacters (such as semicolons, pipes, or backticks) to inject and execute arbitrary system commands. The affected software versions are 0.1.0, 0.1.1, and 0.2.1.\nThe attack flow proceeds as follows: First, the local attacker identifies the availability of the mcp-ffmpeg-helper tool and targets the handleToolCall function interface. Second, the attacker crafts a malicious payload containing shell commands embedded within the format argument. Third, the application processes the input within src/tools/handlers.ts and passes the unsanitized string to the operating system execution environment. Fourth, the shell parses the command string, executing both the intended ffmpeg-related operation and the attacker's injected commands with the privileges of the local process.\nRegarding authentication and network exposure requirements, the vulnerability does not require network exposure as attacking locally is a requirement. Privilege requirements depend on the execution context of the hosting application, but successful execution grants the attacker whatever privileges the application process holds on the host system. Payload behavior involves direct execution of arbitrary binaries or system utilities, leading to potential post-exploitation activities such as privilege escalation, lateral movement, persistence establishment, and exfiltration of sensitive local data."
}