Summary
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability in file-processing operations that construct shell commands for ffmpeg.
If an attacker can influence file names passed to concat(), cut(), or merge(), shell metacharacters may be interpreted and allow arbitrary commands to run with the privileges of the Node.js process.
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability in file-processing operations that construct shell commands for ffmpeg.
If an attacker can influence file names passed to concat(), cut(), or merge(), shell metacharacters may be interpreted and allow arbitrary commands to run with the privileges of the Node.js process.
Affected context
The issue occurs in Video-stitch workflows that pass attacker-influenced or insufficiently validated file names to concat(), cut(), or merge(). These operations invoke ffmpeg through shell-executed command lines and interpolate file names without adequate quoting or isolation. Exploitation risk depends on whether an untrusted user, uploaded asset, external job, or other upstream input can control the relevant file names.
The issue occurs in Video-stitch workflows that pass attacker-influenced or insufficiently validated file names to concat(), cut(), or merge(). These operations invoke ffmpeg through shell-executed command lines and interpolate file names without adequate quoting or isolation. Exploitation risk depends on whether an untrusted user, uploaded asset, external job, or other upstream input can control the relevant file names.
Exploit preconditions
- Attack surface: Video-stitch file-processing APIs and the ffmpeg invocation path
- Required access: Ability to influence file names supplied to
concat(),cut(), ormerge() - Trigger point: Construction and execution of the ffmpeg command line
- Why exploitation is possible: File names are interpolated into a shell command without reliably separating data from shell syntax
- Execution context: Commands run with the permissions available to the Node.js process
- Attack surface: Video-stitch file-processing APIs and the ffmpeg invocation path
- Required access: Ability to influence file names supplied to
concat(),cut(), ormerge() - Trigger point: Construction and execution of the ffmpeg command line
- Why exploitation is possible: File names are interpolated into a shell command without reliably separating data from shell syntax
- Execution context: Commands run with the permissions available to the Node.js process
Why this happens
The vulnerability is caused by constructing a shell command from file names that are treated as trusted data. When user-controlled strings are interpolated into a shell-executed ffmpeg command, shell metacharacters can alter command interpretation instead of remaining ordinary file-name content.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The insecure pattern is the use of a shell as an intermediary for data that has not been safely separated, constrained, or neutralized.
The vulnerability is caused by constructing a shell command from file names that are treated as trusted data. When user-controlled strings are interpolated into a shell-executed ffmpeg command, shell metacharacters can alter command interpretation instead of remaining ordinary file-name content.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The insecure pattern is the use of a shell as an intermediary for data that has not been safely separated, constrained, or neutralized.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The Node.js application process could be compromised
- Application data, media files, or credentials may be exposed or modified
- Attackers could potentially alter generated media or processing results
- The host or surrounding services could be affected according to process privileges and isolation controls
- An attacker may execute arbitrary operating-system commands
- The Node.js application process could be compromised
- Application data, media files, or credentials may be exposed or modified
- Attackers could potentially alter generated media or processing results
- The host or surrounding services could be affected according to process privileges and isolation controls
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from media-processing workflows and reducing trust in file names.
Common defensive patterns include:
- Invoke ffmpeg through a process API that passes a fixed executable and an argument array without a shell
- Treat file names as data and apply strict allowlist-based validation for permitted formats and locations
- Use secure temporary directories and canonicalize paths to reduce path and argument ambiguity
- Avoid deriving command-line options from user-controlled values
- Run media-processing workers with least privilege and suitable filesystem, network, and container isolation
- Apply resource limits and separate processing identities where practical
Mitigation generally focuses on removing shell interpretation from media-processing workflows and reducing trust in file names.
Common defensive patterns include:
- Invoke ffmpeg through a process API that passes a fixed executable and an argument array without a shell
- Treat file names as data and apply strict allowlist-based validation for permitted formats and locations
- Use secure temporary directories and canonicalize paths to reduce path and argument ambiguity
- Avoid deriving command-line options from user-controlled values
- Run media-processing workers with least privilege and suitable filesystem, network, and container isolation
- Apply resource limits and separate processing identities where practical
How teams detect issues like this
Detection can include static analysis for shell-enabled process execution, string interpolation in command templates, and calls that pass user-controlled values to child-process APIs.
Code review should look for ffmpeg or other executable invocations that concatenate file names, accept arbitrary shell commands, or rely on quoting as the primary security boundary. Policy enforcement can require shell-free process execution, validated path handling, and approved argument-construction helpers. Runtime monitoring may also identify unexpected child processes, command interpreters, or access to files outside designated media directories.
Detection can include static analysis for shell-enabled process execution, string interpolation in command templates, and calls that pass user-controlled values to child-process APIs.
Code review should look for ffmpeg or other executable invocations that concatenate file names, accept arbitrary shell commands, or rely on quoting as the primary security boundary. Policy enforcement can require shell-free process execution, validated path handling, and approved argument-construction helpers. Runtime monitoring may also identify unexpected child processes, command interpreters, or access to files outside designated media directories.
