Executive brief
Remotion, a framework for creating videos programmatically with React, contains a vulnerability in its Studio component. This flaw allows an attacker to write files to unauthorized locations on the server's filesystem. If exploited, this could lead to a complete system compromise or the disruption of video production operations.
Technical details
An arbitrary file write vulnerability (CWE-123) exists in Remotion Studio due to insufficient protection on API endpoints that interact with the filesystem. Specifically, the `/api/open-in-file-explorer` and `handleAddAsset()` endpoints were found to be vulnerable. A remote attacker can exploit this over the network without authentication or user interaction to write arbitrary data to unintended locations. This can potentially lead to remote code execution if an attacker overwrites sensitive system files or application scripts. The issue is fixed in version 4.0.410 by implementing better protection for filesystem-touching endpoints.
Affected products
- remotion-dev Remotion < 4.0.410
Timeline
- 2026-01-22: other: Vulnerable version v4.0.409 released
- 2026-01-26: patched: Version v4.0.410 released with fix
- 2026-06-15: disclosed: CVE-2026-30121 published