MAL-2026-11460 Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c0780d44a66914255959e786d3ef18ae49763037a2d714a0a610ef1cc1187 lib/report.js imports childprocess, fs, https, and os and collects host identity and environment data via os.hostname, os.userInfo, execSync..., and...

Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c0780d44a66914255959e786d3ef18ae49763037a2d714a0a610ef1cc1187 lib/report.js imports childprocess, fs, https, and os and collects host identity and environment data via os.hostname, os.userInfo, execSync..., and...

Write-what-where Condition

Overview @remotion/studio is an APIs for interacting with the Remotion Studio Affected versions of this package are vulnerable to Write-what-where Condition via the file write process. An attacker can overwrite or create arbitrary files by sending specially crafted input to the application...

Remotion: arbitrary file write vulnerability

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

GHSA-G6PC-6676-C23J Remotion: arbitrary file write vulnerability

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

Remotion: remote code execution (RCE) vulnerability

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution RCE vulnerability...

Arbitrary Code Injection

Overview @remotion/studio is an APIs for interacting with the Remotion Studio Affected versions of this package are vulnerable to Arbitrary Code Injection through the process responsible for handling remote inputs. An attacker can execute arbitrary code by sending specially crafted requests over...

NPM: Remotion: arbitrary file write vulnerability

NPM: Remotion: arbitrary file write vulnerability discovered by ? in WordPress Npm remotion versions 4.0.410...

Write-what-where Condition

Overview @remotion/studio-server is a Run a Remotion Studio with a server backend Affected versions of this package are vulnerable to Write-what-where Condition via the file write process. An attacker can overwrite or create arbitrary files by sending specially crafted input to the application...

Arbitrary Code Injection

Overview @remotion/studio-server is a Run a Remotion Studio with a server backend Affected versions of this package are vulnerable to Arbitrary Code Injection through the process responsible for handling remote inputs. An attacker can execute arbitrary code by sending specially crafted requests...

GHSA-2JQP-F4GR-44FR Remotion: remote code execution (RCE) vulnerability

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution RCE vulnerability...

EUVD-2026-36744

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

EUVD-2026-36743

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution RCE vulnerability...

NPM: Remotion: remote code execution (RCE) vulnerability

NPM: Remotion: remote code execution RCE vulnerability discovered by ? in WordPress Npm remotion versions 4.0.410...

CVE-2026-30121

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

CVE-2026-30120

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution RCE vulnerability...

CVE-2026-30120

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution RCE vulnerability...

CVE-2026-30121

The CVE refers to CVE-2026-30121 affecting Remotion v4.0.409, describing an arbitrary file write vulnerability. The connected sources consistently identify the issue as arbitrary file write in Remotion, but none provide concrete technical details such as vulnerable component/trigger, root cause, ...

CVE-2026-30121

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

CVE-2026-30120

CVE-2026-30120 concerns the Remotion project: remotion v4.0.409 has a reported remote code execution (RCE) vulnerability. The NVD/NVD-derived entries and ENISA/EUVD mirrors describe an exploit with a CVSS v3.1 base score of 9.8 (CRITICAL), attack vector NETWORK, no privileges required, no user in...