An open‑source video platform contains a flaw in the sanitizeFFmpegCommand() function that removes many shell metacharacters but fails to strip the Bash command substitution syntax $(). The sanitized command is executed via sh -c inside execAsync(), so a crafted encrypted ffmpeg payload can cause arbitrary command execution on the standalone encoder server, compromising confidentiality, integrity, and availability.

The affected vendor is WWBN, product AVideo. Versions up to and including 26.0 contain the vulnerability; newer releases include the patched implementation.

The CVSS score of 8.1 indicates high severity. The EPSS score of 2% suggests a modest probability of exploitation, though lower than many high‑profile vulnerabilities. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector requires the attacker to submit a crafted encrypted ffmpeg payload to the standalone encoder, which then executes the command via a double‑quoted sh -c context. Therefore, if the standalone encoder is reachable from an attacker or if an attacker has the ability to supply such a payload, arbitrary command execution is possible, illustrating a remote exploitation scenario.