Is CVE-2026-110645 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110645?

CVE-2026-110645 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-110645

Description

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.