CVE-2026-85696

SadTalker, an open-source talking-head video generation tool, is vulnerable to OS command injection (CWE-78) in its video muxing process, where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. An attacker can upload an audio file whose filename contains shell metacharacters; when video generation runs, the crafted filename breaks out of the quoted ffmpeg arguments and arbitrary system commands execute on the host. Successful exploitation yields remote command execution on the server with high impact to the host's confidentiality, integrity, and availability, reflected in the critical CVSS 4.0 score of 9.3 (network vector, no privileges or user interaction required). All SadTalker deployments that pass uploaded audio through the affected muxing code path are affected; the advisory data does not specify affected or fixed version numbers. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates a 1.5% probability of exploitation within 30 days (72nd percentile).

What to do: Until a patched release is available, sanitize or strip shell metacharacters from uploaded filenames or invoke ffmpeg without shell interpolation, and do not expose the upload/generation endpoint to unauthenticated users. Operators of internet-facing SadTalker instances should restrict who can upload audio and trigger generation, run the service under a low-privilege account or container, and monitor the upstream repository for an official fix; no fixed version number is provided in the current data.