Potential Command Injection in codem-transcode (GHSA-rph7-j9qr-h8q8)
Published: 2017-11-28T22:20:17Z
Aliases: CVE-2013-7377
Severity: HIGH · CWE: CWE-77

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution.

### Mitigating Factors:
The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.


## Recommendation

An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..

Affected packages:
package: ecosystem: npm
name: codem-transcode
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.0