CVE-2026-117568

HighCVSS 7.0/10Last modified Oct 28, 2026

Description

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
bitscorp-mcp	mcp-ffmpeg	<= 1.0.5

References

Timeline

Published: Oct 27, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1175697.8Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows CVE-2026-117576.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Technologies Ltd. Co. B CVE-2026-1175705.2Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets CVE-2026-1175718.8The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public vis CVE-2026-1175724.1The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL CVE-2026-1175737.8hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting CVE-2026-1175749.1A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request s CVE-2026-1175884.3The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configura CVE-2026-11769.8A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index CVE-2026-1176017.5Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to r CVE-2026-1176028.4Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module whe CVE-2026-1176034.3Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to