--- title: "CVE-2026-110645: Video-stitch - Command Injection" description: "Video-stitch < 2.0.0-beta.1 contains a command injection caused by unquoted file names interpolated into shell-executed ffmpeg commands, letting attackers execute OS commands with Node.js process privileges, exploit requires attacker to influence file names." url: https://panop.io/threat-heartbeat/CVE-2026-110645/ --- # CVE-2026-110645 Video-stitch - Command Injection Video-stitch < 2.0.0-beta.1 contains a command injection caused by unquoted file names interpolated into shell-executed ffmpeg commands, letting attackers execute OS commands with Node.js process privileges, exploit requires attacker to influence file names. CVSS base score 9.8 /10 Critical CISA KEV Not listed Public exploit None known Authentication Not required [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-110645) ## Details Type Command Injection Impact Remote Code Execution CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Published 14 October 2026 Updated 15 October 2026 Weakness [CWE-78](https://cwe.mitre.org/data/definitions/78.html) ## Vendor fix Update to version 2.0.0-beta.1 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-110645](https://nvd.nist.gov/vuln/detail/CVE-2026-110645) - [https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61](https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videoconcat.js#L61) - [https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99](https://github.com/ArsalanDotMe/VideoStitch/blob/f33560852c848fe572a79f45ae0e85a7bcb0d3b2/lib/videocut.js#L96-L99) - [https://github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9b](https://github.com/ArsalanDotMe/VideoStitch/commit/ba60353e6c3707e6ff5d89eb6d76c2c6cdb0df9b) - [https://github.com/ArsalanDotMe/VideoStitch/pull/26](https://github.com/ArsalanDotMe/VideoStitch/pull/26) - [https://github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1](https://github.com/ArsalanDotMe/VideoStitch/tree/v2.0.0-beta.1) - [https://www.vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cut](https://www.vulncheck.com/advisories/video-stitch-before-2.0.0-beta.1-os-command-injection-via-concat-and-cut) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)