Executive brief
ffmpegdotjs is a Node.js library that wraps FFmpeg for video processing tasks like trimming, conversion, and compression. A command injection vulnerability in the trimvideo function allows attackers to execute arbitrary system commands by injecting malicious input, potentially compromising the server or application hosting this library.
Technical details
A command injection vulnerability (CWE-77) exists in ffmpegdotjs due to unsafe use of Node.js child_process.exec() without input sanitization. The trimvideo function concatenates user-controlled input directly into shell commands, allowing an attacker to break out of the intended command context and execute arbitrary OS commands. The vulnerability affects all versions through 0.0.4. Attack requires the application to pass untrusted user input to the trimvideo function; no authentication or special privileges are required. An attacker can achieve remote code execution with the privileges of the process running the Node.js application.
Affected products
- TRomesh ffmpegdotjs all versions through 0.0.4
Timeline
- 2021-04-18: disclosed
- 2021-05-06: advisory