CVE-2026-110645 in Video-stitch
Summary
by MITRE • 10/14/2026
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The video-stitch library, prior to version 2.0.0-beta.1, contains a critical OS command injection vulnerability that stems from improper neutralization of special elements used in an operating system command. This flaw is rooted in how the application constructs shell commands for processing multimedia files using ffmpeg. Specifically, when functions such as concat(), cut(), or merge() are invoked to manipulate video segments, the library interpolates file names directly into the command string without proper quoting or sanitization. If these file paths contain special characters that have meaning to the operating system's command interpreter, they can be exploited to alter the intended behavior of the shell command.
The technical mechanism behind this vulnerability involves the interpolation of user-supplied input, specifically file names, into a shell-executed ffmpeg command line. Because the file name is not enclosed in quotes or properly escaped, any metacharacters present within the path are interpreted by the shell rather than treated as literal data. For instance, an attacker could supply a file name ending with a semicolon followed by arbitrary commands, such as ; rm -rf /, which would be executed immediately after the intended ffmpeg operation completes. This allows for the injection of additional system calls that run with the same privileges as the Node.js process executing video-stitch.
The operational impact of this vulnerability is severe, potentially leading to full remote code execution on the affected server or application host. An attacker who can influence file names passed to these functions can execute arbitrary commands, read sensitive files, modify system configurations, or use the compromised node in further attacks against other systems within the network. This represents a significant risk for applications that handle user-uploaded media content, as it allows an unauthenticated or low-privileged user to escalate their access and compromise the integrity of the underlying infrastructure.
This vulnerability aligns with CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. In terms of attack tactics, this exploitation method corresponds to MITRE ATT&CK technique T1059, specifically sub-technique 004 for Unix Shell Commands, where adversaries use shell commands to execute actions on a target system. The lack of input validation and safe command construction practices highlights the importance of adhering to secure coding standards that prevent direct interpolation of user data into system calls.
To mitigate this vulnerability, developers must upgrade video-stitch to version 2.0.0-beta.1 or later, where these issues have been addressed through improved handling of file paths. In cases where upgrading is not immediately feasible, a defensive programming approach should be adopted by validating and sanitizing all input related to file names before they are passed to the library functions. This includes ensuring that only expected characters are present in file paths and avoiding the use of shell execution methods for tasks that can be performed using native Node.js APIs or safer libraries designed specifically for media processing without invoking external shells.