CVE-2026-55173
1 advisory.
Packagist/wwbn/avideo CVE-2026-55173: high 8.1, EPSS 3.43%
AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 29.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-wc3f-xc32-435f
- https://github.com/WWBN/AVideo/security/advisories/GHSA-wc3f-xc32-435f
- https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1f
- https://github.com/WWBN/AVideo
CVE-2026-55173 · published · modified · JSON