OS Command Injection Vulnerability in SadTalker by OpenTalker
CVE-2026-85696

9.3CRITICAL

Key Information:

Vendor

Opentalker

Status
Sadtalker
Vendor
CVE Published:
4 September 2026

What is CVE-2026-85696?

SadTalker, developed by OpenTalker, is susceptible to an OS command injection flaw in its video muxing process. This vulnerability arises when uploaded audio filenames, which may contain shell metacharacters, are not properly escaped before being incorporated into ffmpeg commands. Attackers can exploit this weakness by uploading malicious audio files, allowing them to execute arbitrary system commands during the video generation phase. This security concern highlights the need for stringent input validation and command execution practices.

Affected Version(s)

SadTalker 0 <= 0.0.2

References

https://github.com/OpenTalker/SadTalker/issues/1043
issue-tracking
https://github.com/OpenTalker/SadTalker
product
https://github.com/OpenTalker/SadTalker/blob/v0.0.2/src/u...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.