CVE-2026-117568 mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117568?
CVE-2026-117568 is a high-severity vulnerability in bitscorp-mcp mcp-ffmpeg, published on 27 Oct 2026.
Official description
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
Weakness: CWE-78
Which versions are affected by CVE-2026-117568?
How do I fix CVE-2026-117568?
No fix has been published for CVE-2026-117568 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-117568 being exploited?
There is no known exploitation of CVE-2026-117568 in the wild and no public exploit code.
Sources
Also known as GHSA-cqrv-cwxw-xcq4.