Video-stitch CVE-2026-110645 Allows OS Command Injection in Node.js

The National Vulnerability Database has published details for CVE-2026-110645, a critical OS command injection flaw in the Video-stitch library. This vulnerability allows attackers to execute arbitrary system commands by manipulating file names passed to specific video processing functions.

What happened

Video-stitch versions prior to 2.0.0-beta.1 contain a severe security weakness classified as CWE-78. According to the NVD record, the library interpolates user-supplied file names directly into shell-executed ffmpeg command lines without proper quoting. This design error enables an attacker who can influence file names to inject shell metacharacters into the command string.

The vulnerability specifically impacts the concat(), cut(), and merge() functions within the library. When these functions process malicious file names, the underlying shell interprets the injected characters as valid command operators. This allows the execution of arbitrary operating system commands with the same privileges as the running Node.js process.

Why it matters

The National Vulnerability Database assigns this flaw a CVSS score of 9.3, categorizing it as Critical. This high severity reflects the significant impact on system integrity. Attackers who influence file names passed to the vulnerable functions can inject shell metacharacters to run commands.

The flaw allows execution of commands with the Node.js process privileges. Since Video-stitch is used for video processing tasks, systems handling file names passed to these functions are at risk. The lack of input sanitization makes this a direct path for command execution within the process context.

What to watch

• Monitor for unexpected processes spawned by the Node.js runtime on servers using Video-stitch.
• Check system logs for ffmpeg command lines containing unusual shell metacharacters or syntax.
• Verify that all instances of Video-stitch are updated to version 2.0.0-beta.1 or later.
• Audit file name inputs passed to concat, cut, and merge functions for potential injection attempts.

Who needs to act first

Teams should prioritize updating any applications that accept file names for video processing. Systems processing files passed to the vulnerable functions are the most exposed to this injection vector. Before deploying updates, verify compatibility in a staging environment to ensure video processing workflows remain intact. Back up current configurations and libraries to allow for quick rollback if issues arise. If immediate patching is not possible, restrict file name inputs to alphanumeric characters only to mitigate the risk.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Video-stitch

• Identify all servers and containers running Video-stitch versions earlier than 2.0.0-beta.1.
• Review application code to see if file names from untrusted sources reach ffmpeg commands.
• Implement strict input validation to reject file names containing shell metacharacters like semicolons.
• Wait for the vendor to provide an official update before applying changes to production systems.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Video-stitch are affected by CVE-2026-110645?

All versions of Video-stitch prior to 2.0.0-beta.1 are affected by this vulnerability.

How do attackers exploit this OS command injection flaw?

Attackers supply malicious file names to the concat, cut, or merge functions to inject shell commands.

Is there a confirmed fix for CVE-2026-110645?

The NVD record indicates that version 2.0.0-beta.1 addresses this vulnerability.