| शीर्षक | sworddut mcp-ffmpeg-helper (FFmpeg MCP Server; npm @sworddut/mcp-ffmpeg-helper) <=0.2.1 (0.1.0, 0.1.1, 0.2.1; no fixed release) OS Command Injection |
|---|
| विवरण | A vulnerability was found in sworddut mcp-ffmpeg-helper (FFmpeg MCP Server), all published versions up to and including 0.2.1 (0.1.0, 0.1.1, 0.2.1; no fixed release exists). The MCP tool handler handleToolCall() in src/tools/handlers.ts builds ffmpeg command strings by directly interpolating tool-call arguments into a shell command without validation, quoting or escaping. In the extract_audio tool the format parameter is taken as String(args?.format || 'mp3') (handlers.ts line 42) and concatenated unquoted into: -i "${inputPath}" -vn -acodec ${format} "${outputPath}" -y (handlers.ts line 45). That string is passed to runFFmpegCommand() in src/utils/ffmpeg.ts, which executes it through child_process.spawn(command, args, { shell: true }). Because the shell interprets the string, shell metacharacters in format (or in the other unvalidated parameters options, codec, pixelFormat, extraOptions, startTime, duration, endTime, and the extract_frames format) break out of the intended ffmpeg invocation and run arbitrary operating-system commands with the privileges of the process hosting the MCP server. The arguments originate from LLM/agent tool-call input, so the flaw is reachable through indirect prompt injection or attacker-controlled content or filenames the agent is asked to process. This is genuine OS command injection (CWE-78), not merely ffmpeg-argument injection; no sanitization guard exists on the path (validatePath() only performs an existsSync check on input paths and does not touch these parameters).
Proof of concept (benign, local only): npm i @sworddut/mcp-ffmpeg-helper ; printf '' > /tmp/in.mp4 ; then call handleToolCall('extract_audio', {inputPath:'/tmp/in.mp4', outputPath:'/tmp/out.mp3', format:'mp3 ; id > /tmp/kholiev_ffmpeg_poc.txt ; true'}). The string handed to the shell becomes: ffmpeg -i "/tmp/in.mp4" -vn -acodec mp3 ; id > /tmp/kholiev_ffmpeg_poc.txt ; true "/tmp/out.mp3" -y , which creates /tmp/kholiev_ffmpeg_poc.txt containing the output of id, proving arbitrary command execution. The proof of concept is non-destructive and performs no network activity.
Suggested fix: invoke ffmpeg with an argument array and shell:false (each option and path a discrete argv element), and allowlist the format/codec parameters.
CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Base 7.8). CWE-78.
Public reference (coordinated disclosure): https://github.com/sworddut/mcp-ffmpeg-helper/issues/6
npm: https://www.npmjs.com/package/@sworddut/mcp-ffmpeg-helper
Researcher: Mykhailo Kholiev. |
|---|
| स्रोत | ⚠️ https://github.com/sworddut/mcp-ffmpeg-helper/issues/6 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 11/07/2026 12:30 PM (1 महीना पहले) |
|---|
| संयम | 24/08/2026 05:41 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394711 [sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1 Tool src/tools/handlers.ts handleToolCall format अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|