Description

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T15:17:48.523Z",
  "pubdate": "2026-09-04T15:17:48.523Z",
  "executiveSummary": "SadTalker is susceptible to an OS command injection vulnerability residing in the video muxing module. The flaw exists due to the insecure handling of user-supplied audio filenames during the invocation of system-level ffmpeg commands. By crafting malicious filenames containing shell metacharacters, an attacker can break out of the intended argument context, leading to arbitrary command execution on the host operating system.\nThe vulnerability poses a severe risk, as successful exploitation allows an unauthenticated attacker to execute code with the privileges of the application process. This could result in full system compromise, data exfiltration, or lateral movement within the infrastructure. Because the flaw is triggered during the standard video generation workflow, it represents a significant threat to any public-facing installation of the software that permits user audio uploads.",
  "technicalDetails": "The root cause of the vulnerability is an improper implementation of input validation and sanitization when constructing shell commands. Specifically, the application processes user-uploaded audio files by passing their filenames directly into a command string for execution by the system shell, typically through functions like os.system() or subprocess.run(shell=True). The implementation fails to apply robust shell escaping or use parameterized API calls, allowing the shell to interpret metacharacters provided within the filename.\nThe attack flow begins when an attacker uploads an audio file with a specifically crafted filename. The filename acts as a vehicle for the payload, utilizing shell syntax such as semicolons (;), backticks (`), or logical operators (&&, ||) to terminate the intended ffmpeg command and inject arbitrary shell commands. For example, a filename structured as 'test.wav; id > /tmp/pwned; #.wav' allows an attacker to execute the 'id' command or any other binary available in the system path.\nDuring the video generation process, the backend invokes the muxing utility. When the shell parses the command line, it interprets the metacharacters inside the filename string rather than treating the filename as a literal string argument. Consequently, the injected payload is executed by the underlying shell sub-process before or during the ffmpeg execution. This does not require specialized authentication if the application's upload endpoint is exposed to the public internet.\nThe impact is critical because the command executes with the same effective permissions as the user running the SadTalker service. An attacker can leverage this access to perform a variety of post-exploitation activities, including credential harvesting, installation of persistent backdoors, or complete infrastructure compromise. The vulnerability demonstrates a failure to adhere to secure coding principles regarding command-line argument handling, specifically the lack of separation between command logic and user-controlled data."
}