{"id":"CVE-2026-30120","aliases":["GHSA-2jqp-f4gr-44fr"],"title":"Remotion: remote code execution (RCE) vulnerability","summary":"Remotion: remote code execution (RCE) vulnerability","severity":"critical","cvss":9.8,"cwe":["CWE-94"],"vendor":"remotion","product":"remotion","ecosystem":"npm","affected":["remotion < 4.0.410"],"patched":["remotion 4.0.410"],"published":"2026-06-15","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2jqp-f4gr-44fr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30120"},{"url":"https://github.com/EaEa0001/security-advisories/blob/main/CVE-2026-30120.md"},{"url":"https://github.com/remotion-dev/remotion/pull/6378"},{"url":"https://github.com/remotion-dev/remotion/releases/tag/v4.0.410"},{"url":"https://github.com/advisories/GHSA-2jqp-f4gr-44fr"}],"tags":["ghsa","npm"],"epss":0.00811,"epssPercentile":0.55442,"ingestedAt":"2026-07-07T15:41:58.395Z","slug":"CVE-2026-30120","body":"## Overview\n\nremotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.\n\n## Affected packages\n\n- `remotion < 4.0.410`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `remotion 4.0.410`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}