WWBN AVideo's sanitizeFFmpegCommand() function failed to fully neutralize special shell characters, specifically missing the single ampersand (&) in its denylist. This omission allows an attacker who can supply a crafted encrypted payload to inject multiple chained OS commands via the execAsync() function that executes shell commands. The vulnerability is a continuation of CVE-2026-33482, where command substitution using $(...) was previously exploited. Although redirection operators like > are stripped, the & operator enables chaining commands such as downloading and executing malicious files. The vulnerability affects versions 29.0 and earlier and has been fixed in a commit referenced in the advisory.

Successful exploitation allows an unauthenticated attacker with the ability to craft a valid encrypted payload to execute arbitrary OS commands on the standalone encoder server. This can lead to full compromise of the server, including confidentiality, integrity, and availability impacts. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity with no privileges or user interaction.

A fix for this vulnerability has been committed by the vendor in the referenced GitHub commit (https://github.com/WWBN/AVideo/commit/c1cfa2bea8a351a1d07f5758f82887403e3abf1). Users should update to a version including this patch to remediate the issue. Patch status is not explicitly stated as released in a versioned product, so users should monitor the vendor repository and advisories for official releases containing this fix. Until patched, avoid processing untrusted encrypted payloads that could be used to inject commands.