CVE-2026-110645
Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()
ArsalanDotMe video-stitch
CVSS
9.3CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 14 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)3.25%Chance of exploitation activity in the next 30 days, higher than 88% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.0.0-beta.1video-stitchCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
Text from CVE List
Affected versions 1
- video-stitchaffected: all versions before 2.0.0-beta.1CVE List
References 6
- github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9bFixvia CVE List
- vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cutAdvisoryvia CVE List
- github.com/ArsalanDotMe/VideoStitch/pull/26Exploitvia CVE List
- github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61Referencevia CVE List
- github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99Referencevia CVE List
- github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1Referencevia CVE List