FFmpeg CLI

• Analyzed: May 12, 2026, 3:08 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8ba9d16a01dd8470ce65aa5846e2ea106af4054bc3bb020236abd2ed489e42bc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `merge.sh` script is vulnerable to command injection. It constructs a temporary file (`TEMP_LIST`) from user-supplied arguments without sanitization and then uses `ffmpeg -f concat -safe 0 -i "$TEMP_LIST"`. The `-safe 0` option disables security checks for the concat demuxer, allowing `ffmpeg` to interpret `file 'pipe:...'` entries in the list as commands. A malicious actor providing crafted input (e.g., `file 'pipe:cat /etc/passwd'`) to the `merge.sh` script could achieve arbitrary command execution or data exfiltration, making this a significant risky capability.