VulnSocial

CVE-2026-117568

LOWCVSS 7.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-31: 110-31
Referenced assets1 URL
By indicator
Full discourse1 post
  • Soluciones para Todos@soluparatodosok

    ¿Editás vídeo con Claude u otro agente usando mcp-ffmpeg? Ojo: tiene una falla grave (CVE-2026-117568). Un vídeo con nombre trucado puede ejecutar comandos en tu compu. Todavía no hay arreglo: sacalo de tu config por ahora. https://x.com/jcinjpn/status/2116194202967224345

    0000091
    12.6K followersView on X

Explore more

Back to dashboard