Executive brief
Remotion is a library for programmatically creating videos using React. The Studio component (a visual development environment) contained insufficiently protected endpoints that handle filesystem operations. An attacker could exploit this to execute arbitrary code on a machine running a vulnerable version of Remotion Studio, potentially compromising projects and enabling lateral movement within development environments.
Technical details
This is a remote code execution vulnerability (CWE-94, improper control of generation of code) in Remotion's @remotion/studio package, specifically affecting filesystem-handling endpoints. The vulnerability exists in v4.0.409 and was remedied in v4.0.410 through hardened endpoint protection mechanisms. The attack is likely network-reachable with no authentication required, given that Studio is typically accessed as a web interface. By exploiting improperly validated filesystem operations, an attacker can achieve arbitrary code execution in the context of the Studio process, compromising the development environment and potentially the underlying system.
Affected products
- remotion-dev Remotion v4.0.409 and earlier; fixed in v4.0.410
Timeline
- 2026-06-15: disclosed: Vulnerability advisory published
- 2026-01-26: patched: Fix released in Remotion v4.0.410
- 2026-01-22: other: Vulnerable version v4.0.409 released