{"id":"CVE-2026-117568","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-117568","summary":"mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video,…","details":"mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.","published":"2026-10-27T14:16:39.327","modified":"2026-10-28T17:18:16.677","cvss":{"score":7,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/bitscorp-mcp/mcp-ffmpeg"},{"type":"WEB","url":"https://github.com/bitscorp-mcp/mcp-ffmpeg/blob/2ec04e44850cc5ee5354c40643be8bc91c218654/src/mcp-ffmpeg.ts#L184"},{"type":"WEB","url":"https://github.com/bitscorp-mcp/mcp-ffmpeg/issues/8"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/mcp-ffmpeg-through-1.0.5-os-command-injection-via-videopath-and-outputdir"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T17:18:16.677"}}