Executive brief
mcp-ffmpeg-helper is a Model Context Protocol server that wraps FFmpeg for video processing tasks. A local attacker can inject arbitrary shell commands through unvalidated tool arguments (like audio format or codec), allowing OS-level code execution with the privileges of the MCP server process.
Technical details
The vulnerability is an OS command injection in src/tools/handlers.ts. Tool arguments (format, codec, options, timestamps) are interpolated directly into shell command strings without validation or escaping, then executed via child_process.spawn() with shell:true. An attacker with ability to influence tool call arguments—such as an agent receiving attacker-controlled filenames or indirect prompt injection—can embed shell metacharacters (;, |, &&, $(), backticks) to break out of the FFmpeg invocation and execute arbitrary commands. The fix requires building argument arrays instead of command strings and disabling shell parsing (shell:false).
Affected products
- sworddut mcp-ffmpeg-helper 0.1.0, 0.1.1, 0.2.1
Timeline
- 2026-07-11: disclosed: Coordinated disclosure via GitHub issue #6
- 2026-08-24: advisory: CVE-2026-78430 published