Description
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bitscorp-mcp | mcp-ffmpeg | ≤ 1.0.5 | — |
References
- GitHub Issue #8 issue-tracking
- https://github.com/bitscorp-mcp/mcp-ffmpeg product
- https://github.com/bitscorp-mcp/mcp-ffmpeg/blob/2ec04e44850cc5ee5354c40643be8bc91c218654/src/mcp-ffmpeg.ts#L184 technical-description
- VulnCheck Advisory: mcp-ffmpeg through 1.0.5 OS Command Injection via videoPath and outputDir third-party-advisory