MAL-2026-11460 Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c0780d44a66914255959e786d3ef18ae49763037a2d714a0a610ef1cc1187 lib/report.js imports childprocess, fs, https, and os and collects host identity and environment data via os.hostname, os.userInfo, execSync..., and...

Malware in create-remotion

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in create-remotion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c0780d44a66914255959e786d3ef18ae49763037a2d714a0a610ef1cc1187 lib/report.js imports childprocess, fs, https, and os and collects host identity and environment data via os.hostname, os.userInfo, execSync..., and...

Malicious Package

Overview create-remotion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Remotion: arbitrary file write vulnerability

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

Write-what-where Condition

Overview @remotion/studio is an APIs for interacting with the Remotion Studio Affected versions of this package are vulnerable to Write-what-where Condition via the file write process. An attacker can overwrite or create arbitrary files by sending specially crafted input to the application...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.16, <=0.1.24) +96 more potentially affected by CVE-2026-30121 via remotion (>=4.0.0-2x.1, <=4.0.409)

remotion NPM version =4.0.0-2x.1, =1.0.0, =0.1.16, =6.0.1, =8.0.3, =0.1.38, =0.1.91, =0.1.0, =5.2.0, =0.0.2, =1.0.0, =1.0.0, =0.1.4, =0.1.27 and more Source cves: CVE-2026-30121 Source advisory: OSV:GHSA-G6PC-6676-C23J...

GHSA-G6PC-6676-C23J Remotion: arbitrary file write vulnerability

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

NPM: Remotion: arbitrary file write vulnerability

NPM: Remotion: arbitrary file write vulnerability discovered by ? in WordPress Npm remotion versions 4.0.410...

Write-what-where Condition

Overview @remotion/studio-server is a Run a Remotion Studio with a server backend Affected versions of this package are vulnerable to Write-what-where Condition via the file write process. An attacker can overwrite or create arbitrary files by sending specially crafted input to the application...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.17, <=0.1.24) +27 more potentially affected by CVE-2026-30121 via @remotion/studio-server (>=4.0.91, <=4.0.409)

@remotion/studio-server NPM version =4.0.91, =1.0.0, =0.1.17, =1.0.0, =1.0.0, =0.1.4, =0.1.3, =0.1.4, =0.1.0, =3.0.4, =4.0.91, =4.0.91, =4.0.91, =4.0.260, =1.0.0, =1.0.20 and more Source cves: CVE-2026-30121 Source advisory: SNYK:JS-REMOTIONSTUDIOSERVER-17817236...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.16, <=0.1.24) +96 more potentially affected by CVE-2026-30120 via remotion (>=4.0.0-2x.1, <=4.0.409)

remotion NPM version =4.0.0-2x.1, =1.0.0, =0.1.16, =6.0.1, =8.0.3, =0.1.38, =0.1.91, =0.1.0, =5.2.0, =0.0.2, =1.0.0, =1.0.0, =0.1.4, =0.1.27 and more Source cves: CVE-2026-30120 Source advisory: OSV:GHSA-2JQP-F4GR-44FR...

Arbitrary Code Injection

Overview @remotion/studio is an APIs for interacting with the Remotion Studio Affected versions of this package are vulnerable to Arbitrary Code Injection through the process responsible for handling remote inputs. An attacker can execute arbitrary code by sending specially crafted requests over...

Arbitrary Code Injection

Overview @remotion/studio-server is a Run a Remotion Studio with a server backend Affected versions of this package are vulnerable to Arbitrary Code Injection through the process responsible for handling remote inputs. An attacker can execute arbitrary code by sending specially crafted requests...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.17, <=0.1.24) +45 more potentially affected by CVE-2026-30120 via @remotion/studio (>=4.0.81, <=4.0.409)

@remotion/studio NPM version =4.0.81, =1.0.0, =0.1.17, =0.1.38, =1.0.0, =1.0.0, =0.1.4, =0.1.3, =0.1.4, =0.1.0, =3.0.4, =4.0.90, =4.0.81, =4.0.81, =4.0.81, =4.0.409 and more Source cves: CVE-2026-30120 Source advisory: SNYK:JS-REMOTIONSTUDIO-17817237...

Remotion: remote code execution (RCE) vulnerability

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution RCE vulnerability...

EUVD-2026-36744

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

NPM: Remotion: remote code execution (RCE) vulnerability

NPM: Remotion: remote code execution RCE vulnerability discovered by ? in WordPress Npm remotion versions 4.0.410...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.16, <=0.1.24) +96 more potentially affected by CVE-2026-30120 via remotion (>=4.0.0-2x.1, <=4.0.409)

remotion NPM version =4.0.0-2x.1, =1.0.0, =0.1.16, =6.0.1, =8.0.3, =0.1.38, =0.1.91, =0.1.0, =5.2.0, =0.0.2, =1.0.0, =1.0.0, =0.1.4, =0.1.27 and more Source cves: CVE-2026-30120 Source advisory: GHSA-2JQP-F4GR-44FR...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.16, <=0.1.24) +96 more potentially affected by CVE-2026-30121 via remotion (>=4.0.0-2x.1, <=4.0.409)

remotion NPM version =4.0.0-2x.1, =1.0.0, =0.1.16, =6.0.1, =8.0.3, =0.1.38, =0.1.91, =0.1.0, =5.2.0, =0.0.2, =1.0.0, =1.0.0, =0.1.4, =0.1.27 and more Source cves: CVE-2026-30121 Source advisory: GHSA-G6PC-6676-C23J...