CVE-2026-110645: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ArsalanDotMe video-stitch

CVE-2026-110645 describes an OS command injection vulnerability in ArsalanDotMe's video-stitch software prior to version 2.0.0-beta.1. The vulnerability arises because file names supplied to concat(), cut(), or merge() functions are interpolated into ffmpeg command lines without proper quoting or sanitization. This improper neutralization of special shell characters enables attackers to inject arbitrary shell commands, which execute with the Node.js process privileges. The CVSS 4.0 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the host running video-stitch with the privileges of the Node.js process. This can lead to full system compromise, data loss, or service disruption. The vulnerability is critical due to its high CVSS score and the absence of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or restrict input to concat(), cut(), and merge() functions to trusted file names only. Implement input validation and sanitization to prevent injection of shell metacharacters.