Description
AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | < 29.0 | 29.0 |
References
- GitHub Security Advisory (GHSA-rc5x-vh5v-473f) vendor-advisory
- VulnCheck Advisory: AVideo before 29.0 OS Command Injection via execAsync third-party-advisory