CVE-2026-30120: remotion-dev remotion v4

Synopsis

Remote code execution vulnerability in remotion-dev remotion v4.0.409 allows an unauthenticated attacker to reach the affected service over the network and execute arbitrary code on the host. No credentials or victim interaction are required, making this exploitable by any party with network access to the service. Successful exploitation gives the attacker full control over the host process, with high impact to confidentiality, integrity, and availability. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send a malicious request from any remote host without requiring LAN or physical access.

• AuthenticationNot required

  No credentials of any privilege level are needed; the exploit is available to any unauthenticated caller.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; the exploit triggers through a direct request to the service.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions to succeed.

Blast Radius

• Reads any file or secret accessible to the host process, including environment variables, credentials, and private keys.
• Writes or overwrites arbitrary files on the host filesystem, enabling persistent backdoor installation or data corruption.
• Executes operating system commands with the privileges of the running container process, enabling lateral movement or further exploitation of the surrounding infrastructure.
• Crashes or destabilizes the affected service, causing a denial of service for any workload depending on it.