CVE Intelligence

ArsalanDotMe vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ArsalanDotMe products: 1 record(s), with severity, exploitation and fixes.

Video-stitch 1

Exploited only (KEV) →

CVE-2026-110645 Critical · 9.8 CWE-78 Oct 14, 2026
Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut()
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.