CVE-2026-117568 in mcp-ffmpeg
Summary
by MITRE • 10/27/2026
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in mcp-ffmpeg versions through 1.0.5 represents a critical OS Command Injection flaw that stems from insufficient input validation within the tool's core functionality. This security defect allows remote attackers to achieve arbitrary code execution on the host system by manipulating specific parameters passed to the library's primary tools, namely resize-video, extract-audio, and get-video-info. The root cause lies in how these functions handle user-supplied file paths for videoPath or outputDir arguments without properly sanitizing special shell characters. When a malicious actor provides crafted input containing command substitution syntax such as dollar-sign parentheses $(), backticks, or unescaped closing double quotes within an existing file or directory name, the underlying child_process.exec function interprets these sequences not as literal filename components but as executable shell commands. This failure to escape metacharacters effectively breaks out of the intended string context, allowing the attacker's injected payload to be executed with the privileges of the user running the MCP server process.
From a technical perspective, this vulnerability exploits the inherent risks associated with passing unsanitized strings directly to operating system command interpreters via Node.js child processes. The attack vector is particularly insidious because it leverages legitimate file or directory names that an attacker might control or influence within the filesystem structure accessible to the application. By embedding shell metacharacters into these paths, the attacker forces the execution engine to parse and run additional commands alongside the intended ffmpeg operation. This mechanism bypasses any logical controls designed to restrict operations to specific media processing tasks, effectively granting the attacker full command-line access to the underlying operating system environment where the server is deployed.
The operational impact of this vulnerability is severe, as successful exploitation leads directly to Remote Code Execution with the context and permissions of the MCP server user. Depending on the deployment configuration, this could result in complete compromise of the host machine, including unauthorized data exfiltration, installation of persistent backdoors, lateral movement within a network, or denial-of-service conditions through resource exhaustion. If the server is running under a privileged account, such as root or administrator, the attacker gains full control over the system. Even if run with limited privileges, the ability to execute arbitrary commands can often be leveraged for privilege escalation attacks against other local services or users on the same host.
This flaw aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is categorized under MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically reflecting patterns where attackers use shell commands to execute arbitrary code. To mitigate this risk, immediate action should be taken by upgrading mcp-ffmpeg to a version that includes proper input sanitization or uses safer execution methods such as child_process.execFile with an array of arguments rather than string concatenation. Additionally, developers implementing the library should enforce strict allowlists for file paths and directory names, ensuring that only alphanumeric characters, hyphens, underscores, and periods are permitted in user-supplied path components. Implementing these controls prevents the injection of shell metacharacters and neutralizes the attack vector entirely until a patched version is deployed across all affected environments.