CVE-2026-78430

Name of the Vulnerable Software and Affected Versions mcp-ffmpeg-helper versions 0.1.0 through 0.2.1

Description An OS command injection issue exists within the Tool Handler component, specifically in the handleToolCall() function located in the src/tools/handlers.ts file. This occurs when the format argument is manipulated, allowing for the execution of arbitrary operating system commands. Local access is required to exploit this flaw.

Recommendations As a temporary workaround, restrict the use of the handleToolCall() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.