Detect Remotion RCE via Code Injection (CVE-2026-30120) in Google Chronicle
Detects exploitation of CVE-2026-30120, a critical remote code execution vulnerability in the Remotion npm package (versions < 4.0.410). The vulnerability stems from improper code injection controls (CWE-94), allowing attackers to execute arbitrary code in environments running vulnerable Remotion versions. A public PoC exists, elevating exploitation risk.
MITRE ATT&CK
- Tactic
- Execution Persistence Lateral Movement
YARA-L Detection Query
rule cve_2026_30120_remotion_rce {
meta:
author = "df00tech Detection Engineering"
description = "Detects CVE-2026-30120 Remotion RCE exploitation via code injection"
severity = "CRITICAL"
priority = "HIGH"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30120"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
$e.target.process.command_line = /remotion/ nocase or
$e.target.process.command_line = /@remotion/ nocase
)
(
$e.target.process.command_line = /child_process/ nocase or
$e.target.process.command_line = /execSync/ nocase or
$e.target.process.command_line = /spawnSync/ nocase or
$e.target.process.command_line = /eval\(/ or
$e.target.process.command_line = /Function\(/
)
condition:
$e
}Chronicle YARA-L rule detecting process launch events with Remotion references combined with known JavaScript code injection primitives exploited in CVE-2026-30120.
Data Sources
Required Tables
False Positives & Tuning
- Remotion cloud rendering jobs that legitimately execute Node.js worker scripts
- CI/CD systems using Remotion for automated video generation in build pipelines
- Security researchers reproducing the PoC in isolated lab environments
Other platforms for CVE-2026-30120
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Remotion Code Injection via eval()
Expected signal: Process launch event for node with command line containing 'remotion' and 'eval('. Child process event for 'id' command spawned from node. File creation event for /tmp/cve_2026_30120_test.txt.
- Test 2Simulate Remotion execSync Child Process Spawn
Expected signal: Process event for node with title 'remotion-renderer'. child_process module load. Execution of 'whoami'. File write to /tmp/remotion_rce_test.txt.
- Test 3Simulate Remotion RCE on Windows via spawnSync
Expected signal: DeviceProcessEvents entry for node.exe with 'remotion' and 'spawnSync' in CommandLine. Child process event for cmd.exe spawned from node.exe. File write event for remotion_rce_test.txt in TEMP directory.
Unlock Pro Content
Get the full detection package for CVE-2026-30120 including response playbook, investigation guide, and atomic red team tests.