CVE-2021-23376: 
JavaScript vulnerability analysis and mitigation

CVE-2021-23376 affects all versions of the ffmpegdotjs package, a FFMPEG module for NodeJS. The vulnerability was disclosed on February 23, 2021, and published on April 18, 2021. This security issue allows attackers to execute arbitrary commands through the trimvideo function due to insufficient input sanitization (Snyk Advisory).

The vulnerability stems from improper neutralization of special elements used in an OS Command (OS Command Injection, CWE-78). The issue specifically occurs in the trimvideo function, which uses the child_process exec function without proper input sanitization. The vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

Successful exploitation of this vulnerability can result in total loss of confidentiality, integrity, and availability of the affected system. An attacker can execute arbitrary commands on the target system, potentially leading to complete system compromise (Snyk Advisory).

The vulnerability is easily exploitable, requiring no special privileges or user interaction. A proof-of-concept exploit has been publicly documented. For example, an attacker can execute arbitrary commands by passing malicious input to the trimvideo function: 'ffmpegdotjs.trimvideo("package-lock.json",0,30,"n || touch success; #")' (Snyk Advisory).

There is no fixed version available for the ffmpegdotjs package. Users are advised to discontinue use of the package and seek alternative solutions (Snyk Advisory).