AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can…

Critical CVSS 9.8

CVECVE-2026-64625

First seen2026-07-21 00:15 UTC

Disclosed2026-07-20 22:17 UTC

Last updated2026-07-21 00:15 UTC

Channel statusauto

Summary

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://github.com/WWBN/AVideo/security/advisories/GHSA-rc5x-vh5v-473f
https://www.vulncheck.com/advisories/avideo-before-os-command-injection-via-execasync

Timeline

2026-07-21 nvd_ingest NVD