https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-28T12:26:25.823598+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-117568 fkie_cve-2026-117568 2026-10-28T12:26:25.826316+00:00

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.

 https://db.gcve.eu/vuln/ghsa-cqrv-cwxw-xcq4 GHSA-cqrv-cwxw-xcq4 2026-10-28T12:26:25.826400+00:00

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.