AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand()

published 2026-03-20 7 mo ago modified 2026-06-17 4 mo ago also GHSA-pmj8-r2j7-xg6c , EUVD-2026-14439

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 4.3%; EPSS 4.3% chance of exploitation in 30 days, percentile 91%
public exploits: 0; none known

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters (`&&`, `;`, `|`, `` ` ``, `<`, `>`). However, it fails to strip `$()` (bash command substitution syntax). Since the sanitized command is executed inside a double-quoted `sh -c` context in `execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.

Patch / fix

links 1

github.com/WWBN/AVideo@25c8ab9 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-03-23)

Exploit prediction

4.28% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	wwbn/avideo	<=26.0	no fix listed

Affected products

WWBN AVideo

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

github.com /WWBN/AVideo/commit/25c8ab90269e3a01fb4cf205b40a373487f022e1
web, patch
github.com /WWBN/AVideo/security/advisories/GHSA-pmj8-r2j7-xg6c
web, exploit, mitigation, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2026-33482
advisory
github.com /WWBN/AVideo
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary