CVE-2026-33482
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters ( , , , ` ` $() sh -c execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205b40a373487f022e1 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters ( , , , $() sh -c execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters ( , , , $() sh -c execAsync()`, an attacker who can craft a valid encrypted payload can achieve arbitrary command execution on the standalone encoder server. Commit 25c8ab90269e3a01fb4cf205
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33482
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33482
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in is designed to prevent OS command injection in ffmpeg commands by stripping dangerous shell metacharacters ( , `;
nvd.nist.gov