https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T00:48:50.636342+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-109237 EUVD-2026-109237 2026-10-16T00:48:50.639360+00:00 EUVD-2026-109237 https://cve.radiocsirt.org/vuln/fkie_cve-2013-7377 fkie_cve-2013-7377 2026-10-16T00:48:50.639389+00:00

The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.

 https://cve.radiocsirt.org/vuln/ghsa-rph7-j9qr-h8q8 GHSA-rph7-j9qr-h8q8 — Potential Command Injection in codem-transcode 2026-10-16T00:48:50.639419+00:00

Affected: npm: codem-transcode

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution.

### Mitigating Factors: The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default.

## Recommendation

An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..

 https://cve.radiocsirt.org/vuln/gsd-2013-7377 gsd-2013-7377 2026-10-16T00:48:50.639447+00:00 gsd-2013-7377 https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-7377 Withdrawn: UBUNTU-CVE-2013-7377 2026-10-16T00:48:50.639459+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: nodejs, Ubuntu:Pro:16.04:LTS: nodejs, Ubuntu:Pro:18.04:LTS: nodejs

The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.