CVE-2026-110645

Deferred Deferred - Pending Action

Video-stitch OS Command Injection via Unquoted File Names

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110645

EUVD

EUVD-2026-101273

Affected Vendors & Products

Vendor	Product	Version / Range
ArsalanDotMe	video-stitch	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in Video-stitch versions before 2.0.0-beta.1. It allows attackers to execute arbitrary commands by supplying file names containing shell metacharacters to functions like concat(), cut(), or merge(). These functions construct ffmpeg commands as strings and execute them via shelljs.exec, which interprets unquoted file names as commands.

Detection Guidance

Check if VideoStitch versions before 2.0.0-beta.1 are installed by running: npm list video-stitch. If the version is <=1.7.1, the system is vulnerable. Review code using shelljs.exec in functions like concat(), cut(), or merge() in lib/videoconcat.js or lib/videocut.js.

Impact Analysis

If you use a vulnerable version of Video-stitch, attackers could run arbitrary commands on your system with the same privileges as the Node.js process. This could lead to data theft, system compromise, or further network infiltration. The impact is severe due to the high CVSS score (9.3) and the ability to execute commands remotely.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to insufficient security controls.

Mitigation Strategies

Upgrade to VideoStitch 2.0.0-beta.1 or later. If upgrading is not possible, replace shelljs.exec with child_process.execFile and pass arguments as an array to prevent shell interpretation. Avoid using untrusted file names in concat(), cut(), or merge() functions.

Hi! I’m here to help you understand CVE-2026-110645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70