CVE-2026-64625

CVE-2026-64625 affects AVideo before 29.0. The issue stems from an incomplete fix for CVE-2026-45578: execAsync() re-wraps escaped commands in double-quoted sh -c, enabling command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.ph...