Threats affecting pkg:npm/mcp-ffmpeg

mcp-ffmpeg versions up to 1.0.5 contain an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by providing specially crafted input values for videoPath or outputDir parameters in certain tools. The vulnerability arises from improper neutralization of special shell characters, enabling command string breakouts and execution with the MCP server user's privileges.