Video‑stitch builds ffmpeg command lines from file names supplied to concat(), cut(), or merge() without sanitizing them. Because the file names are interpolated unquoted into shell‑executed ffmpeg calls, an attacker who controls those names can inject shell metacharacters and execute arbitrary commands with the privileges of the running Node.js process. This OS command injection (CWE‑78) can compromise the confidentiality, integrity, and availability of the host system.

ArsalanDotMe’s Video‑stitch application versions prior to 2.0.0‑beta.1 are affected. The vulnerability resides in the concat(), cut(), and merge() functions that construct ffmpeg commands from user‑controlled file names.

The CVSS score of 9.3 denotes a high‑severity vulnerability, and the EPSS score of 3% indicates a moderate probability of exploitation. Based on the description, it is inferred that an attacker must be able to supply or modify file names that are passed to the vulnerable functions, for example through a web interface or a file‑upload feature, but no authentication or authorization checks are mentioned. Exploitation is straightforward because the affected code executes the constructed ffmpeg command directly in the operating‑system shell, allowing an attacker to run arbitrary commands with Node.js process privileges. The vulnerability is not listed in CISA’s KEV catalog.