Threats tagged 'ghsa-cqrv-cwxw-xcq4'

mcp-ffmpeg versions through 1.0.5 have an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by providing specially crafted videoPath or outputDir inputs to certain tools. The vulnerability arises from improper handling of these inputs in child_process.exec calls, enabling command injection via shell metacharacters.