Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Security: Command injection via unsanitized ffmpeg exec() template literal [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#54285•Fetched 2026-04-08 01:29:39
View on GitHub
Comments
1
Participants
2
Timeline
4
Reactions
0
Author
jinduwang1001-maxjinduwang1001-max
Participants
jinduwang1001-maxjinduwang1001-maxvincentkocvincentkoc
Timeline (top)
closed ×1commented ×1labeled ×1locked ×1

extractVideoThumb in the WhatsApp/media handling code uses child_process.exec() with unsanitized template literals:

exec(`ffmpeg -ss ${time} -i ${path} -y -vf scale=${size.width}:-1 -vframes 1 -f image2 ${destPath}`)

All four parameters (time, path, size.width, destPath) are interpolated directly into a shell command string. exec() invokes /bin/sh -c, so shell metacharacters in any parameter enable arbitrary command execution.

Root Cause

extractVideoThumb in the WhatsApp/media handling code uses child_process.exec() with unsanitized template literals:

exec(`ffmpeg -ss ${time} -i ${path} -y -vf scale=${size.width}:-1 -vframes 1 -f image2 ${destPath}`)

All four parameters (time, path, size.width, destPath) are interpolated directly into a shell command string. exec() invokes /bin/sh -c, so shell metacharacters in any parameter enable arbitrary command execution.

Code Example

exec(`ffmpeg -ss ${time} -i ${path} -y -vf scale=${size.width}:-1 -vframes 1 -f image2 ${destPath}`)
RAW_BUFFERClick to expand / collapse

Summary

extractVideoThumb in the WhatsApp/media handling code uses child_process.exec() with unsanitized template literals:

exec(`ffmpeg -ss ${time} -i ${path} -y -vf scale=${size.width}:-1 -vframes 1 -f image2 ${destPath}`)

All four parameters (time, path, size.width, destPath) are interpolated directly into a shell command string. exec() invokes /bin/sh -c, so shell metacharacters in any parameter enable arbitrary command execution.

Impact

Currently the only observed caller uses hardcoded values ("00:00:00", {width:32}), limiting immediate exploitability. However, the function is exported and reusable — any future caller passing user-influenced file paths (e.g., a filename containing $(cmd) or backticks) would achieve full RCE.

A malicious filename like "; rm -rf / #.mp4 would execute arbitrary commands.

Location

Compiled: dist/session-BFZksknu.js:81775

Suggested Fix

Replace exec() with spawn("ffmpeg", [...args]) using array-based arguments. Never interpolate paths into shell command strings.

Audit Method

Pattern A (consistency comparison) — other shell invocations in the codebase use shellEscape() or spawn() with argument arrays; this one does not.

extent analysis

Fix Plan

To fix the vulnerability, replace the exec() function with spawn() and pass arguments as an array. This prevents shell metacharacters in the parameters from being executed.

  • Replace the vulnerable line with the following code:
const { spawn } = require('child_process');
const ffmpeg = spawn('ffmpeg', [
  '-ss', time,
  '-i', path,
  '-y',
  '-vf', `scale=${size.width}:-1`,
  '-vframes', '1',
  '-f', 'image2',
  destPath
]);
  • Ensure that the ffmpeg command is properly waited for and handled:
ffmpeg.stdout.on('data', (data) => {
  console.log(`stdout: ${data}`);
});

ffmpeg.stderr.on('data', (data) => {
  console.error(`stderr: ${data}`);
});

ffmpeg.on('close', (code) => {
  console.log(`child process exited with code ${code}`);
});

Verification

To verify the fix, test the extractVideoThumb function with a malicious filename, such as "; rm -rf / #.mp4", and ensure that it does not execute arbitrary commands.

Extra Tips

  • Always use array-based arguments when invoking shell commands to prevent shell injection vulnerabilities.
  • Consider using a library like fluent-ffmpeg to interact with FFmpeg, which provides a safer and more convenient API.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#prompt template#agent execution#callback error#memory management#API rate limit

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING