Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Untrusted input may cause errors in FFMPEG SDK

CVE-2020-28435 · published 4 years ago
Summary

All versions of FFMPEG SDK are vulnerable to errors caused by untrusted input. This could lead to unexpected behavior or crashes in applications using the SDK. Update to the latest version of FFMPEG SDK to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
npm shajanjp ffmpeg-sdk <= 0.0.5
– ffmpeg-sdk_project ffmpeg-sdk All versions
cpe:2.3:a:ffmpeg-sdk_project:ffmpeg-sdk:*:*:*:*:*:node.js:*:*
Original advisory text
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
CWE-78OS Command Injection
Timeline
Published25 Jul 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rwvf-c3wm-qm6w · GHSA
CVE-2020-28435 · NVD
Track software like this
Free during beta