Video-stitch Unquoted Filename Vulnerability Enables Critical Shell Command Injection Before 2.0.0-beta.1

The ArsalanDotMe video-stitch library contains an operating system command injection flaw that allows attackers to execute commands. This issue impacts versions released before 2.0.0-beta.1. The vulnerability exists because the library interpolates user-supplied file names directly into shell-executed ffmpeg command lines without proper quoting or sanitization. This specific bug class enables remote code execution within the context of the application's runtime environment.

Root cause

The underlying issue stems from how the library constructs ffmpeg commands. When file names are passed to the library, they are inserted into shell strings without being quoted or escaped. This behavior is classified under CWE-78, which relates to improper neutralization of special elements used in an OS command. The NVD record for CVE-2026-110645 identifies this as a critical severity issue, assigning it a CVSS score of 9.3.

Attack path

Attackers exploit this by controlling the file names provided to the library. Specifically, if an attacker can influence the file names passed to the concat(), cut(), or merge() functions, they can inject shell metacharacters. These characters allow the execution of arbitrary commands within the shell. The commands run with the same privileges as the Node.js process hosting the video-stitch library.

Affected versions

• Video-stitch versions before 2.0.0-beta.1 are affected.
• The vulnerability does not impact version 2.0.0-beta.1 or later releases.
• The library is maintained by ArsalanDotMe.

Mitigation

• Update the video-stitch library to version 2.0.0-beta.1 or a newer release.
• Validate and sanitize all file names before passing them to the library functions.
• Restrict the permissions of the Node.js process to limit potential impact.

Signals worth monitoring

Teams usually detect OS command injection by monitoring for unexpected shell processes spawned by application services. Check whether ffmpeg instances are launched with unusual arguments or from unexpected parent processes. Look for commands that include shell metacharacters like semicolons or pipes in process trees. Review audit logs for file access patterns that deviate from normal video processing workflows. If suspicious activity is found, isolate the affected host and revoke network access to prevent lateral movement or data exfiltration.

Background: Command injection

Command injection occurs when an application passes untrusted input directly to a system shell. This allows attackers to execute arbitrary commands on the server. You prevent it by avoiding shell execution entirely or by strictly validating and escaping all user-supplied input before processing.

Read the full guide: Command Injection: How It Works and How to Stop It

What to do and how to stay safe: Video-stitch

• Review dependency lists for the video-stitch library and identify current versions in use.
• Monitor process creation logs for ffmpeg commands that include shell metacharacters.
• Implement strict input validation for file names before they reach the library.
• Once the vendor provides an update, test and deploy the patched version promptly.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110645?

The CVSS score is 9.3, which is rated as Critical severity.

Which functions in video-stitch are vulnerable to this injection?

The concat(), cut(), and merge() functions are vulnerable when they process unquoted file names.

Does this vulnerability allow full system compromise?

The commands run with the privileges of the Node.js process, not necessarily full root access.