CVE-2026-30120: Remotion RCE Vulnerability Explained

CVE-2026-30120 Overview

CVE-2026-30120 is a remote code execution (RCE) vulnerability in remotion-dev/remotion version 4.0.409, an open-source framework for programmatically creating videos in React. The flaw is classified under [CWE-94] Improper Control of Generation of Code (Code Injection). An unauthenticated attacker can execute arbitrary code over the network without user interaction.

Critical Impact
Successful exploitation grants attackers full code execution on systems running the affected Remotion version, compromising confidentiality, integrity, and availability of the host.

Affected Products

remotion-dev/remotion version 4.0.409
Node.js applications and CI/CD pipelines embedding Remotion 4.0.409
Downstream packages depending on remotion:remotion4.0.409

Discovery Timeline

2026-06-15 - CVE-2026-30120 published to NVD
2026-06-17 - Last updated in NVD database
2026-06-18 - EPSS scoring data published

Technical Details for CVE-2026-30120

Vulnerability Analysis

The vulnerability resides in remotion-dev/remotion4.0.409, a Node.js framework used to render videos from React components. Remotion processes user-supplied input, including composition props, configuration files, and rendering parameters, during video generation workflows.

The flaw is categorized as [CWE-94] Improper Control of Generation of Code. Attacker-controlled input reaches a code generation or evaluation sink without adequate sanitization, allowing arbitrary JavaScript to execute in the rendering process. Network attack vector and lack of authentication requirements make this a critical risk for any internet-facing Remotion deployment.

Root Cause

The root cause is unsafe handling of input that is interpolated into code that the framework later evaluates or compiles. When Remotion constructs render bundles, project configuration, or composition metadata, attacker-controlled values are not properly escaped or validated. The result is injection of executable JavaScript into a trusted execution context within the Node.js process.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker submits crafted input to a service that invokes Remotion 4.0.409 to render or bundle a composition. Typical exposure points include rendering APIs, server-side bundling endpoints, and CI workflows that accept untrusted parameters. Once the malicious payload reaches the vulnerable sink, attacker code runs with the privileges of the rendering process.

No public proof-of-concept exploit is currently linked from the advisory. Technical details are tracked in the GitHub Security Advisory for CVE-2026-30120.

Detection Methods for CVE-2026-30120

Indicators of Compromise

Unexpected child processes spawned by Node.js workers running Remotion rendering jobs.
Outbound network connections from rendering hosts to unfamiliar domains or IP addresses during or after bundle compilation.
Modifications to node_modules, render output directories, or environment files coinciding with render requests.
Anomalous require() or dynamic import() calls referencing unexpected modules in process telemetry.

Detection Strategies

Inventory dependencies for remotion@4.0.409 using npm ls remotion or Software Bill of Materials (SBOM) scanning across build agents and production hosts.
Apply behavioral monitoring to Node.js processes invoking Remotion render functions and alert on process-spawn lineage that deviates from baseline.
Inspect HTTP request payloads sent to render endpoints for fields that contain JavaScript syntax, template literals, or shell metacharacters.

Monitoring Recommendations

Forward Node.js application logs, process telemetry, and EDR events into a centralized data lake for correlation across build, CI, and runtime tiers.
Add identification rules that flag execution of node processes followed by sh, bash, cmd.exe, or powershell.exe child processes.
Monitor package registries and developer workstations for installation of remotion@4.0.409 to prevent reintroduction after remediation.

How to Mitigate CVE-2026-30120

Immediate Actions Required

Identify all systems, CI runners, and container images that include remotion@4.0.409 and isolate any internet-exposed rendering services.
Upgrade Remotion to a fixed version once published by the maintainers, then redeploy affected services and rebuild container images.
Rotate secrets, API tokens, and signing keys that were accessible to compromised rendering processes.
Audit recent render jobs and CI logs for anomalous input or output that may indicate exploitation attempts.

Patch Information

At time of publication, the NVD entry references the GitHub Security Advisory for CVE-2026-30120. Consult that advisory for the fixed version and upgrade guidance. Until a patched release is applied, treat all deployments of 4.0.409 as vulnerable.

Workarounds

Remove Remotion from any service that accepts untrusted input until a patched version is installed.
Run rendering workloads inside hardened, network-restricted containers with no outbound internet access and minimal filesystem privileges.
Validate and strictly allow-list all input fields passed into Remotion compositions, configuration files, and bundling commands.
Apply egress filtering at the network layer to block command-and-control callbacks from rendering hosts.

bash

# Inventory and remove vulnerable Remotion versions
npm ls remotion
npm uninstall remotion
# After the vendor publishes a fixed release, install the patched version
npm install remotion@<fixed-version>