SadTalker ffmpeg Filename Command Injection

Technical Analysis

CVE-2026-85696 (CVSS 9.8) arises from improper input sanitization where uploaded audio filenames are string-concatenated into ffmpeg command invocations rather than passed as properly escaped/quoted arguments or via safe subprocess APIs (e.g., argument lists without shell=True). An attacker can craft a filename containing shell metacharacters (e.g., `; `, `$()`, backticks) to break out of the intended command context and execute arbitrary OS commands with the privileges of the SadTalker process during video synthesis. This is a classic OS command injection pattern common in ML pipeline tooling that shells out to media processing binaries like ffmpeg without hardening. Successful exploitation grants full remote code execution, enabling data exfiltration, lateral movement, or deployment of secondary payloads. Because SadTalker and similar avatar/video-generation models are frequently wired into autonomous AI agent pipelines and multimedia RAG/tool-use workflows (e.g., agents that accept user-supplied audio and auto-generate video outputs), a compromised host can lead to theft of API keys, model weights, or credentials used by the broader agent framework, making this highly relevant to agent-integrated deployments.

Affected Systems

SadTalker (all versions prior to patch) and any self-hosted or containerized deployments invoking its video muxing/ffmpeg wrapper functions; systems exposing SadTalker as a web service, API endpoint, or backend for AI agent/orchestration frameworks that accept user-supplied audio uploads.

Indicators of Compromise

• No public IOC set available at time of disclosure (zero-day/newly assigned CVE); monitor for anomalous filenames containing shell metacharacters (;, |, &, $(), ``) in upload directories, ffmpeg child processes spawned by SadTalker with unexpected arguments, and unexpected outbound connections from SadTalker hosts.

Remediation Steps

1. 1

   Patch or upgrade

   Apply the vendor patch once released; until then, disable or isolate the video generation/muxing feature.

2. 2

   Sanitize filenames

   Implement strict filename validation/whitelisting (alphanumeric only) or generate internal random filenames instead of using user-supplied names in any shell command.

3. 3

   Use safe subprocess execution

   Refactor ffmpeg invocation to use argument-list based subprocess calls (no shell=True) and pass parameters via arrays rather than string concatenation.

4. 4

   Sandbox and least privilege

   Run SadTalker and ffmpeg processes in a restricted container/sandbox with no access to sensitive credentials, API keys, or internal networks.

5. 5

   Network and monitoring controls

   Deploy WAF rules to block suspicious upload filenames and enable process-level monitoring/EDR to detect anomalous ffmpeg child process spawning.