External risk intelligence

Video-stitch OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110645

The vulnerability exists in a Node.js library used for video processing tasks like concatenation and cutting. While such libraries can be used in web applications, they are typically invoked as backend utility functions rather than as public-facing services. Public internet exposure of the specific file-processing functionality is uncommon and usually restricted to authorized internal workflows.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Video-stitch software could allow attackers to execute arbitrary commands on systems processing video files. This occurs when file names are not properly secured before being used in commands that process video content. At a high level, this could lead to unauthorized command execution with the privileges of the Node.js process running the software.

Unsecured file names allow command execution.
Affects systems processing video files.
Confirm relevance and exposure to Video-stitch.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by influencing file names processed by the video-stitch library, allowing them to inject malicious commands. Since the application does not validate or sanitize these file names before passing them to shell commands, an attacker can execute arbitrary commands on the server with the privileges of the Node.js process.

No authentication or user interaction needed.
Attacker controls interpolated file names.
Leads to arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, attackers could execute arbitrary commands on the server by manipulating file names passed into video processing functions. This could impact the integrity and availability of the Node.js process and any associated data.

Server command execution is at risk.
Malicious file names could be injected.
Service disruption and data compromise are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the VideoStitch Node.js library, likely used by development or platform teams responsible for media processing pipelines. The first practical step is to identify all instances of this library within your environment, determine their exposure, and assess their criticality to business operations. Once identified, the accountable team should be engaged to plan remediation based on risk.

Identify accountable development or platform teams.
Verify library usage and exposure to risk.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Video-stitch and how is it used?

Video-stitch is a Node.js software library designed for programmatic video manipulation. Developers integrate it into media processing pipelines to automate tasks such as cutting, merging, or concatenating video files, often acting as a bridge to external tools like ffmpeg.

What does CVE-2026-110645 mean in plain English?

This vulnerability is an OS command injection, classified as CWE-78. It means the software fails to properly filter file names before using them in commands. An attacker can hide malicious system instructions within a file name; when the software processes that file, the server unintentionally executes those hidden commands as if they were legitimate system tasks.

How can an attacker trigger this vulnerability?

An attacker must be able to influence the file names passed to the library's concat(), cut(), or merge() functions. This triggers the bug by forcing the underlying shell to interpret the injected characters as new commands. Merely having the library installed or running it on static, trusted files does not trigger this vulnerability.

Why does Halo Surface Signal categorize this as unlikely?

Halo Surface Signal notes that while the vulnerability is severe, this library is typically used as a backend utility rather than an internet-facing service. Because the vulnerable file-processing functionality is usually restricted to internal, authorized workflows, it is less likely to be directly accessible to external attackers than a public-facing website.

What should I do if I use Video-stitch?

The first step is to locate all applications in your environment that rely on the Video-stitch library. Once identified, work with the relevant development or platform teams to assess how these applications ingest file names and determine if they are reachable by untrusted users. Prioritize updating the library to version 2.0.0-beta.1 or later to remediate the flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.