CVE-2026-85696

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85696

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85696.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85696

Published

2026-09-04T14:32:38.799Z

Modified

2026-09-06T03:47:20.487731626Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SadTalker OS Command Injection via Audio Filename

Details

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85696.json"
}

References

Affected packages

Git / github.com/opentalker/sadtalker

Affected ranges

Type

GIT

Repo

https://github.com/opentalker/sadtalker

Events

Introduced

Last affected

35dd94f443e5cd542ee3db0b627815d79478196e

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.0.2"
        }
    ]
}

Affected versions

v0.*

v0.0.1

v0.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85696.json"