CVE-2026-110649

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

CVE-2026-110644

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110650

The thumbnail Python package (versions through 1.5 ) is vulnerable to an OS command injection in the generate_thumbnail() function. The root cause is the failure to neutralize shell metacharacters in file paths, allowing an attacker to inject commands into os.system() calls when the package execu...

EUVD-2026-101278

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110650 Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inje...

CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

CVE-2026-110649 Stills before 25.24.2 OS Command Injection via Media File Names

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

EUVD-2026-101277

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $... or backticks to execute operating system commands with Node.js process privileges when ffmpeg,...

CVE-2026-110649

Versions of Stills before 25.24.2 are vulnerable to an OS command injection flaw. The vulnerability occurs when the application processes crafted media file paths containing $(...) or backticks. This allows an attacker to execute arbitrary shell commands with Node.js process privileges during the...

EUVD-2026-101273

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110645 Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat, cut, or merge can inject shell...

CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

EUVD-2026-101272

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $ command substitution or closing quotes, which are interpolated into an...

CVE-2026-110644

The nodejs-whisper library, version 0.3.1 and earlier , is vulnerable to OS Command Injection within the convertToWavType() function. The root cause is the insufficient sanitization of audio file paths, allowing attackers to inject $() command substitution or closing quotes. These inputs are inte...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : FFmpeg vulnerabilities (USN-8915-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8915-1 advisory. Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. A...

Linux Distros Unpatched Vulnerability : CVE-2026-107698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-8680-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8680-1 advisory. Adrian Junge discovered that FFmpeg incorrectly handled certain subtitle data. An attacker could possibly use this...

USN-8915-1 ffmpeg vulnerabilities

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2026-30754 It...

USN-8915-1: FFmpeg vulnerabilities

Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2026-30754 It...