9.3 CVSS: video-stitch <2.0.0-beta.1 Critical Shell Injection via Filenames in Node.js Apps

The National Vulnerability Database published a record for CVE-2026-110645, identifying a critical security flaw in the video-stitch library. This issue impacts Node.js applications using versions before 2.0.0-beta.1. Organizations relying on this tool for video processing face significant exposure if user-controlled data influences file naming conventions within their workflows.

The vulnerability stems from how video-stitch handles filenames in shell-executed ffmpeg command lines. According to the NVD record, filenames are interpolated unquoted into these commands. This lack of quoting allows attackers who influence filenames to inject shell metacharacters. Such injection enables the execution of arbitrary operating system commands with the privileges of the Node.js process.

Technical Context

The flaw is classified under CWE-78, which covers OS command injection weaknesses. The NVD record specifies that the vulnerability exists in the concat, cut, and merge functions of the library. When an attacker supplies a filename containing shell metacharacters to any of these functions, the system interprets the input as executable code rather than a simple file path. This behavior bypasses standard application boundaries.

Affected Systems

Only instances of ArsalanDotMe video-stitch before version 2.0.0-beta.1 are affected by this issue. The NVD record explicitly limits the scope to this specific version range. Applications using newer beta releases or different video processing libraries are not listed as vulnerable in this advisory. Small businesses using custom-built video tools should verify their dependency versions immediately.

Defender's checklist

Security teams should audit all Node.js applications for the presence of the video-stitch library. If the library is present, verify the installed version against the vulnerable range. Review code paths that pass user-supplied data to concat, cut, or merge functions. Ensure that no direct user input reaches these functions without rigorous validation and sanitization. Monitor logs for unusual shell execution patterns originating from ffmpeg processes.

Operational impact

Organizations should assess their video processing workflows for direct user input handling. Teams usually need to determine if external suppliers provide video files that influence processing parameters. Internal developers must be informed of the risk associated with unquoted shell arguments. Compliance officers should evaluate whether this exposure violates data handling requirements for customer content. Risk managers typically require evidence that third-party dependencies are monitored and updated promptly.

What to do and how to stay safe: video-stitch

• Inventory all Node.js projects to identify usage of the video-stitch library.
• Verify that your installed version is not older than 2.0.0-beta.1.
• Implement strict input validation for any filenames passed to video processing functions.
• Monitor system logs for unexpected command executions within the Node.js process environment.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110645?

The National Vulnerability Database rates CVE-2026-110645 as Critical with a CVSS score of 9.3.

Which functions in video-stitch are vulnerable to this injection?

The concat, cut, and merge functions are vulnerable when processing filenames with shell metacharacters.

Is there a confirmed patch available for this vulnerability?

The source material does not confirm a patch, but specifies that versions before 2.0.0-beta.1 are affected.