OS Command Injection Vulnerability in mcp-ffmpeg Affected by Bitscorp
CVE-2026-117568
7.3HIGH
What is CVE-2026-117568?
The mcp-ffmpeg library, up to version 1.0.5, is susceptible to an OS command injection flaw. By manipulating the 'videoPath' or 'outputDir' parameters when invoking the resize-video, extract-audio, and get-video-info functionalities, an attacker can execute arbitrary shell commands on the server. This occurs due to improper handling of user input, where characters like $(), backticks, or closing double quotes can break out of the 'child_process.exec' command context, allowing attackers to run commands as the MCP server user. It's crucial for users to upgrade to a version that addresses this vulnerability.
Affected Version(s)
mcp-ffmpeg 0 <= 1.0.5