CVE-2026-85696criticalCWE-78

CVE-2026-85696: fallo crítico en OpenTalker SadTalker

SadTalker OS Command Injection via Audio Filename

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear SadTalker

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 2.6%
SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
OpenTalker · SadTalker