SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execute arbitrary system commands when video generation occurs.

SadTalker, an open-source AI-driven talking head video generation tool, contains a critical OS command injection vulnerability in its video muxing process. The vulnerability exists in the videoio.py utility where uploaded audio filenames are directly interpolated into ffmpeg shell commands without proper sanitization or escaping. Attackers can craft audio filenames containing shell metacharacters to break out of quoted arguments and execute arbitrary system commands on the host when video generation is triggered. This represents a significant remote code execution risk for any deployment where untrusted users can upload audio files. The vulnerability is tracked as CVE-2026-85696 and affects at least version v0.0.2 of SadTalker. Remediation would require sanitizing or properly escaping user-supplied filenames before inclusion in shell commands, or using subprocess APIs that avoid shell interpolation entirely.