RCE in Arsalandotme Video-Stitch
CVE-2026-110645
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/ArsalanDotMe/VideoStitch/pull/26 (issue-tracking, patch)
- github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0… (patch)
- github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3… (technical-description)
- github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3… (technical-description)
- github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1 (release-notes)
- www.vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-inject… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-110645?
- CVE-2026-110645 is a critical-severity vulnerability in Arsalandotme Video-Stitch, classified under OS Command Injection. CVSS score: 9.8/10. Published 2026-10-14.
- How severe is CVE-2026-110645?
- Critical severity. CVSS v3 base score is 9.8 out of 10.