[ CVE-2026-117568 · Published 27 Oct 2026 ]
Vulnerability in bitscorp-mcp mcp-ffmpeg
CVSS 7.0
EPSS <1%No fix listed yet
[ Description ]Official description
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.