CVE-2026-55173: AVideo Command Injection Vulnerability Due to Incomplete Sanitization
Summary
CVE-2026-55173: The fix for CVE-2026-33482 (GHSA-pmj8-r2j7-xg6c) is incomplete. Affects wwbn/avideo versions < 29.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AVideo is an open-source video platform that allows users to create, manage, and share video content. It provides a range of features including live streaming, video encoding, and user management. However, a critical vulnerability has been identified in its FFmpeg command sanitization process, which can lead to arbitrary OS command execution.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-33482, where the function sanitizeFFmpegCommand fails to neutralize a single '&' character, which is a shell background operator. This oversight allows an attacker to inject arbitrary commands into the system via the execAsync function, leading to potential unauthorized access and control over the server. The vulnerability is classified as high severity with a CVSS score of 8.1, indicating significant risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the '&' character in any FFmpeg commands until the package is updated. You can also modify the sanitizeFFmpegCommand function to include '&' in the denylist by adding the following line: $command =
preg_replace('/&/', '', $command);
Conclusion
The CVE-2026-55173 vulnerability in AVideo poses a significant risk due to its potential for arbitrary command execution. It is crucial for users to update to the latest version of the package to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for wwbn/avideo →
FAQ
CVE-2026-55173 is a vulnerability in AVideo that allows for arbitrary OS command execution due to incomplete sanitization of FFmpeg commands.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized command execution on the server, potentially allowing attackers to gain control over the system.
Yes, a patch is available in version 29.1 of the AVideo package. It is recommended to update to this version or later.
The CVSS score of CVE-2026-55173 is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for wwbn/avideo.
