OS Command Injection in WWBN AVideo Open Source Video Platform
CVE-2026-33482

8.1HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33482?

The WWBN AVideo platform suffers from a significant security flaw due to a weakness in its sanitizeFFmpegCommand() function. This vulnerability relates to an improper handling of command strings which permits attackers, who can craft a valid encrypted payload, to execute arbitrary commands on the standalone encoder server. Although the function is intended to prevent OS command injection by removing certain shell metacharacters, it fails to filter out the $() command substitution syntax. As a result, an attacker could leverage this flaw to manipulate the server's command execution context, jeopardizing the integrity of the system. A fix for this issue has been implemented in commit 25c8ab90269e3a01fb4cf205b40a373487f022e1.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/25c8ab90269e3a01fb4...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.