video-stitch: OS command injection via file names in concat, cut and merge

Summary

The Node.js library video-stitch (npm) builds FFmpeg shell commands with file names inserted unquoted. An attacker who can influence file names passed to concat(), cut() or merge() can inject shell metacharacters and run arbitrary commands with the privileges of the Node.js process. The risk exists only where an application passes user-influenced file or output names to these functions; the CISA SSVC rates the issue as automatable with total technical impact.

Affected

• ArsalanDotMe video-stitch, all versions before 2.0.0-beta.1 according to the CVE record
• The fix pull request states that all published versions up to 1.7.1 are affected
• Unknown whether other 2.x builds are affected

Fixed in

• 1.x line: version 1.7.2 (vendor release notes, fix via shell-free process spawning)
• 2.x line: v2.0.0-beta.1 is a rewrite; a fixed stable 2.x release is unknown
• Note: the CVE range also includes 1.7.2 although the vendor released it as the 1.x fix; the CVE record may be updated later

Workaround

• Configure a trusted FFmpeg executable path
• Apply application-level input validation and file-access controls
• Never pass untrusted file or output names to these functions
• Run the Node.js process with least privilege
• The library is not an FFmpeg protocol or media sandbox, so these measures do not replace patching

Exploitation

• No evidence of exploitation in the wild found in the research; CISA KEV was not checked directly
• CISA SSVC: exploitation status poc, automatable yes, technical impact total
• Public technical details exist in the fix pull request; the reproduction was not verified

Our recommendation

• Search application repositories and lockfiles for video-stitch (for example with npm ls video-stitch)
• Upgrade to version 1.7.2 or to a fixed 2.x release if one is available
• Treat the component as high priority if it is internet-facing or accepts user-supplied file names
• Restrict which file names reach the library and monitor the host for unexpected processes

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record context: VulnCheck advisory www.vulncheck.com
• Fix pull request #26 github.com
• Fix commit ba60353 github.com
• Vulnerable code: videoconcat.js github.com
• Vulnerable code: videocut.js github.com
• VideoStitch v1.7.2 release notes github.com
• VideoStitch v2.0.0-beta.1 tag github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:02.