www.vulncheck.com CVE-2026-117568: OS Command Injection in mcp-ffmpeg Affects Multiple Deployments
Article Content
- •CVE-2026-117568 allows OS command injection in mcp-ffmpeg up to version 1.0.5.
- •Attackers can exploit this vulnerability by crafting specific inputs to execute commands.
- •High-risk environments include MCP deployments with broad filesystem access and untrusted inputs.
CVE-2026-117568 was published on October 27, 2026, detailing an OS command injection vulnerability in mcp-ffmpeg versions up to 1.0.5. This flaw allows attackers to execute arbitrary shell commands by manipulating the videoPath or outputDir parameters in tools like resize-video and extract-audio. The risk is assessed as high due to potential command execution with the service account's permissions, which could expose sensitive data or disrupt processing. Exploitation requires local access or the ability to submit crafted inputs, making it complex but feasible. The vulnerability has not been confirmed as, and no proof-of-concept code is currently available. Organizations using MCP deployments that accept inputs from multiple users are particularly at risk. Immediate action is recommended to mitigate potential impacts.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-117568 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What versions of mcp-ffmpeg are affected?
Is there a patch available for this vulnerability?
What should I do to mitigate the risk?
Continue Reading
Critical RCE Vulnerability in Langflow Exposed CVE-2026-105740 is a critical remote code execution (RCE) vulnerability affecting Langflow versions prior to 1.9.0. Authenticated users can exploit this flaw by adding an MCP server with the 'Stdio' transport, allowing arbitrary OS commands to be executed without validation. The vulnerability was published on October…