CVE-2026-25643

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-25643

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25643.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-25643

Aliases

GHSA-4c97-5jmr-8f6x

Published

2026-02-06T19:16:26.005Z

Modified

2026-03-13T04:10:59.636445Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

Details

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not sanitize user input in the video stream configuration (config.yaml), allowing direct injection of system commands via the exec: directive. The go2rtc service executes these commands without restrictions. This vulnerability is only exploitable by an administrator or users who have exposed their Frigate install to the open internet with no authentication which allows anyone full administrative control. This vulnerability is fixed in 0.16.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-250",
        "CWE-269",
        "CWE-668",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25643.json"
}

References

Affected packages

Git / github.com/blakeblackshear/frigate

Affected ranges

Type: GIT
Repo: https://github.com/blakeblackshear/frigate
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

4131252a3ba4544bf7cb1468bf30bdfd932e2489

Affected versions

0.*

0.1.2

v0.*

v0.0.1

v0.1.0

v0.1.1

v0.10.0

v0.10.1

v0.11.0

v0.11.0-beta2

v0.11.0-beta3

v0.11.0-beta4

v0.11.0-beta5

v0.11.0-beta6

v0.11.0-beta7

v0.11.0-rc1

v0.11.0-rc2

v0.11.0-rc3

v0.11.1

v0.12.0

v0.12.0-beta1

v0.12.0-beta10

v0.12.0-beta2

v0.12.0-beta3

v0.12.0-beta4

v0.12.0-beta5

v0.12.0-beta6

v0.12.0-beta7

v0.12.0-beta8

v0.12.0-beta9

v0.12.0-rc1

v0.12.0-rc2

v0.12.1

v0.13.0

v0.13.0-beta1

v0.13.0-beta2

v0.13.0-beta3

v0.13.0-beta4

v0.13.0-beta5

v0.13.0-beta6

v0.13.0-beta7

v0.13.0-rc1

v0.13.1

v0.13.2

v0.14.0

v0.14.0-beta1

v0.14.0-beta2

v0.14.0-beta3

v0.14.0-beta4

v0.14.0-rc1

v0.14.0-rc2

v0.14.1

v0.15.0

v0.15.0-beta1

v0.15.0-beta2

v0.15.0-beta3

v0.15.0-beta4

v0.15.0-beta5

v0.15.0-beta6

v0.15.0-beta7

v0.15.0-rc1

v0.15.0-rc2

v0.15.1

v0.15.2

v0.16.0

v0.16.0-beta1

v0.16.0-beta2

v0.16.0-beta3

v0.16.0-beta4

v0.16.0-rc1

v0.16.0-rc2

v0.16.0-rc3

v0.16.0-rc4

v0.16.1

v0.16.2

v0.16.3

v0.2.0

v0.2.0-beta

v0.2.1

v0.2.2

v0.2.2-beta

v0.3.0

v0.5.0

v0.5.0-rc2

v0.5.0-rc4

v0.5.1

v0.5.2

v0.6.0

v0.6.0-rc1

v0.6.0-rc2

v0.6.0-rc3

v0.6.1

v0.7.0

v0.7.1

v0.7.2

v0.7.3

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.9.0

v0.9.0-beta1

v0.9.0-beta2

v0.9.0-rc1

v0.9.0-rc2

v0.9.0-rc3

v0.9.0-rc4

v0.9.0-rc5

v0.9.0-rc6

v0.9.1

v0.9.2

v0.9.3

v0.9.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25643.json"