A critical (CVSS 9.8) OS command injection flaw in OpenTalker's SadTalker lets unauthenticated attackers execute arbitrary system commands by uploading an audio file whose filename contains shell metacharacters.
What Is It
SadTalker contains an OS command injection vulnerability (CWE-78) in its video muxing process. According to the VulnCheck advisory, uploaded audio filenames are interpolated directly into ffmpeg commands without proper escaping. An attacker can upload an audio file with shell metacharacters in the filename to break out of quoted arguments, and the injected commands execute when video generation runs.
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). It was disclosed by VulnCheck and published to NVD on 2026-09-04, currently in "Received" status.
Why It Matters
The attack is network-reachable, requires no privileges, no user interaction, and has low complexity; the worst combination available. Impact is rated high across confidentiality, integrity, and availability, which describes an outcome equivalent to full compromise of the host running SadTalker. Because exploitation only requires uploading a file with a crafted name, the barrier to entry is low wherever a deployment accepts audio uploads from untrusted users.
SadTalker is typically operated through a web-based demo interface on GPU-equipped hosts, so where such an instance is reachable by untrusted users, code execution would land on a valuable target. The supplied source material does not establish how many deployments are actually exposed this way, and internet-wide exposure has not been measured here.
Note: This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog based on the supplied data, so there is no confirmed active exploitation and no associated federal remediation deadline at this time.
What's Vulnerable
- Vendor: OpenTalker
- Product: SadTalker
- Affected versions: all versions up to and including 0.0.2 (semver, default status for other versions: unaffected)
The vulnerable code path is referenced in src/utils/videoio.py at tag v0.0.2.
Patch Status
The supplied source material does not identify a fixed version or vendor patch. No remediation guidance or required action is specified in the NVD record. Operators should treat all versions ≤ 0.0.2 as vulnerable and restrict untrusted upload access to SadTalker instances until a fix is confirmed upstream.
Sources
- NVD, CVE-2026-85696: https://nvd.nist.gov/vuln/detail/CVE-2026-85696
- VulnCheck Advisory; SadTalker OS Command Injection via Audio Filename: https://www.vulncheck.com/advisories/sadtalker-os-command-injection-via-audio-filename
- OpenTalker/SadTalker (GitHub): https://github.com/OpenTalker/SadTalker
- SadTalker v0.0.2,
src/utils/videoio.py: https://github.com/OpenTalker/SadTalker/blob/v0.0.2/src/utils/videoio.py - SadTalker GitHub Issue #1043: https://github.com/OpenTalker/SadTalker/issues/1043