Executive brief
SadTalker is an open-source tool used for generating talking face animations from audio and still images. The application fails to properly escape uploaded audio filenames before passing them to system commands, allowing attackers to inject arbitrary shell commands that execute with the application's privileges when video generation occurs. This could result in complete system compromise and unauthorized access to sensitive data.
Technical details
The vulnerability is an OS command injection (CWE-78) in the video muxing process, specifically in the save_video_with_watermark() function in src/utils/videoio.py. User-supplied audio filenames are interpolated directly into ffmpeg command strings via string formatting (using % operator) without any escaping or sanitization, then executed via os.system(). An attacker can craft an audio filename containing shell metacharacters (e.g., backticks, $(), semicolons) to break out of the quoted arguments and execute arbitrary commands. The attack requires the attacker to upload a malicious audio file, but no authentication bypass or network exploit is necessary—the injection occurs during normal video generation workflow. There is no indication that a patch has been released.
Affected products
- OpenTalker SadTalker v0.0.2 and likely earlier versions
Timeline
- 2026-09-04: disclosed