CVE-2025-25286
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in `islandora/crayfish:4.1.0`. Some workarounds are available. The exploit requires making a request against the Homarus's `/convert` endpoint; therefore, the ability to exploit is much reduced if the microservice is not directly accessible from the Internet, so: Prevent general access from the Internet from hitting Homarus. Alternatively or additionally, configure auth in Crayfish to be more strongly required, such that requests with `Authorization` headers that do not validate are rejected before the problematic CLI interpolation occurs.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 1.02%
- CWE
- CWE-150, CWE-157
- Published
- 2025-02-13
- Last modified
- 2026-03-12
Affected products
- Islandora Crayfish
Weakness type
Related vulnerabilities
- CVE-2026-82710 — Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
- CVE-2026-82584 — Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
- CVE-2026-19591 — OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS...
- CVE-2026-72847 — broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
- CVE-2026-75483 — powerlevel10k Control Character Injection via package.json Version
- CVE-2026-73506 — Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
- CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD
- CVE-2026-73036 — Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml