The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.
CVSS 3.0HIGH 8.1·Network·No auth·No interaction·EPSS 0.0198·Published 2017-10-23·Fixed in 0.5.0CWE-77