OS Command Injection in AVideo - #VU161913
Published: November 8, 2026
Vulnerability identifier: #VU161913
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to execute arbitrary operating system commands on an AVideo server.
The vulnerability exists due to execAsync() wrapping assembled commands in a double-quoted shell invocation that leaves command substitution active despite argument escaping. An attacker can supply command substitution payloads through inputs passed to affected execAsync() callers with only argument escaping, causing injected commands to run and create files on the server.
Affected software
AVideo
Remediation
Install security update from vendor's website.
AVideo - update to 29.0