Potential Command Injection in codem-transcode

ALTO 8.1CVE-2013-7377 · GHSA-rph7-j9qr-h8q8 · Published 23/10/2017 · updated 17/06/2026

In breve

CVE-2013-7377 è una vulnerabilità ALTO (CVSS 8.1) che riguarda codem-transcode (codem-transcode project), codem-transcode.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.0%, superiore al 80.7% delle vulnerabilità.
Correzione: aggiornare a 0.5.0 o successiva.

Package	Affected versions	Patched versions
codem-transcode codem-transcode_project	`= 0.4.1= 0.4.2= 0.4.3= 0.4.4= 0.5.0`	No fix yet
codem-transcode npm	`< 0.5.0`	`0.5.0`

Description

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution.

Mitigating Factors:

The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.

Recommendation

An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..

NVD description

The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.

References

nvd.nist.gov/vuln/detail/CVE-2013-7377 · ADVISORY
GitHub Advisory GHSA-rph7-j9qr-h8q8 · ADVISORY
npmjs.com/advisories/2 · WEB
openwall.com/lists/oss-security/2014/05/13/1 · WEB
openwall.com/lists/oss-security/2014/05/15/2 · WEB
nodesecurity.io/advisories/codem-transcode_command_injection · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

codem-transcode

codem-transcode_project

= 0.4.1= 0.4.2= 0.4.3= 0.4.4= 0.5.0

No fix yet

codem-transcode

npm

< 0.5.0

0.5.0

Description

Mitigating Factors:

The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.

Recommendation

An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..

NVD description

The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.