CVE-2026-30120 Google Chronicle · YARA-L

Detect Remotion RCE via Code Injection (CVE-2026-30120) in Google Chronicle

Detects exploitation of CVE-2026-30120, a critical remote code execution vulnerability in the Remotion npm package (versions < 4.0.410). The vulnerability stems from improper code injection controls (CWE-94), allowing attackers to execute arbitrary code in environments running vulnerable Remotion versions. A public PoC exists, elevating exploitation risk.

MITRE ATT&CK

Tactic
Execution Persistence Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_30120_remotion_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-30120 Remotion RCE exploitation via code injection"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-30120"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.target.process.command_line = /remotion/ nocase or
      $e.target.process.command_line = /@remotion/ nocase
    )
    (
      $e.target.process.command_line = /child_process/ nocase or
      $e.target.process.command_line = /execSync/ nocase or
      $e.target.process.command_line = /spawnSync/ nocase or
      $e.target.process.command_line = /eval\(/ or
      $e.target.process.command_line = /Function\(/
    )

  condition:
    $e
}
critical severity medium confidence

Chronicle YARA-L rule detecting process launch events with Remotion references combined with known JavaScript code injection primitives exploited in CVE-2026-30120.

Data Sources

Google ChronicleGoogle Security OperationsEndpoint telemetry via Chronicle forwarder

Required Tables

UDM Events - PROCESS_LAUNCH

False Positives & Tuning

  • Remotion cloud rendering jobs that legitimately execute Node.js worker scripts
  • CI/CD systems using Remotion for automated video generation in build pipelines
  • Security researchers reproducing the PoC in isolated lab environments

Other platforms for CVE-2026-30120

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Remotion Code Injection via eval()

    Expected signal: Process launch event for node with command line containing 'remotion' and 'eval('. Child process event for 'id' command spawned from node. File creation event for /tmp/cve_2026_30120_test.txt.

  2. Test 2Simulate Remotion execSync Child Process Spawn

    Expected signal: Process event for node with title 'remotion-renderer'. child_process module load. Execution of 'whoami'. File write to /tmp/remotion_rce_test.txt.

  3. Test 3Simulate Remotion RCE on Windows via spawnSync

    Expected signal: DeviceProcessEvents entry for node.exe with 'remotion' and 'spawnSync' in CommandLine. Child process event for cmd.exe spawned from node.exe. File write event for remotion_rce_test.txt in TEMP directory.

Last updated: 2026-06-30 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify the host and user account associated with the alert. Determine if Remotion is a legitimately installed package in the environment by checking package.json or node_modules for @remotion/* packages.
  2. Check the installed version of Remotion on the affected host using 'npm list remotion' or inspecting package-lock.json. If version < 4.0.410 is confirmed, treat as actively vulnerable.
  3. Review process tree for the flagged Node.js process. Identify parent process, any spawned child processes, and outbound network connections initiated around the time of the alert.
  4. Cross-reference the alerting host against known Remotion deployment inventory. Unexpected hosts running Remotion (e.g., non-media servers) should be treated with higher suspicion.

Containment

  1. If exploitation is confirmed, immediately isolate the affected host from the network to prevent lateral movement or command-and-control communication. Use EDR network isolation capability if available.
  2. Terminate all Node.js processes associated with Remotion on the affected host and disable any scheduled tasks or services that invoke Remotion until the package is patched to >= 4.0.410.

Evidence Collection

  1. Capture full process memory dump of the suspicious Node.js process before termination. Collect process command-line arguments, environment variables, and loaded modules using tools such as procmon, gcore, or EDR forensic collection.
  2. Collect Node.js application logs, npm audit output, and any available network capture (pcap) from the time window surrounding the alert. Preserve package-lock.json and node_modules directory for dependency analysis.

Escalation Criteria

  • !Escalate immediately if evidence of outbound C2 communication is observed following the suspicious Remotion process execution, particularly to unknown external IPs or domains.
  • !Escalate if the affected host is a production server, cloud rendering node, or any system with access to sensitive data repositories, secrets management systems, or internal APIs.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >node_modules/@remotion/*/package.json — check 'version' field to confirm vulnerable version < 4.0.410 was installed at time of exploitation
  • >npm-debug.log and .npm/_logs/ — may contain evidence of malicious package loading or unexpected module imports during rendering
  • >OS process audit logs (auditd on Linux, Sysmon on Windows) — look for Node.js spawning unexpected shells (sh, bash, cmd, powershell) or file-writing activity in /tmp or %TEMP%

Tuning Guidance

Reduce false positives by building an allowlist of known Remotion deployment hosts (CI/CD servers, media rendering farms) and excluding them from alerting. Additionally, filter on parent process: legitimate Remotion usage is typically initiated by npm, yarn, or a known shell. Alert on Remotion processes with unusual parents such as web servers (nginx worker, apache2), database processes, or remote access tools. Pair detections with npm audit data to confirm the vulnerable version is present before elevating severity.

Hunting Queries

Threat hunt for Node.js processes executing Remotion from unexpected parent processes, which may indicate exploitation outside of normal package manager invocation patterns.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('node', 'node.exe', 'npx', 'npx.cmd')
| where InitiatingProcessFileName !in~ ('npm', 'yarn', 'pnpm', 'sh', 'bash', 'cmd.exe', 'powershell.exe')
| where ProcessCommandLine has_any ('remotion', '@remotion')
| summarize count() by DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by count_ desc
Hunting — SPL
spl 
index=* sourcetype IN ("sysmon", "linux:audit", "node:process")
| search (command_line="*remotion*" OR command_line="*@remotion*")
| where NOT match(parent_process, "npm|yarn|pnpm|sh|bash|cmd.exe|powershell.exe")
| stats count by host, user, command_line, parent_process
| sort - count

Atomic Red Team Tests

Test 1 Simulate Remotion Code Injection via eval()
linux

Simulates CVE-2026-30120 exploitation by invoking Node.js with a Remotion-referencing command that contains an eval() payload. This represents the minimal indicator a detection should fire on.

Command

bash 
node -e "const r = require; console.log('remotion-sim'); eval('require(\"child_process\").execSync(\"id > /tmp/cve_2026_30120_test.txt\")')"

Cleanup

bash 
rm -f /tmp/cve_2026_30120_test.txt

Expected Telemetry

Process launch event for node with command line containing 'remotion' and 'eval('. Child process event for 'id' command spawned from node. File creation event for /tmp/cve_2026_30120_test.txt.

Expected Detection

Alert should fire on the node process command line matching both 'remotion' and 'eval(' patterns.

Test 2 Simulate Remotion execSync Child Process Spawn
linux

Simulates exploitation via execSync, the most common code injection pattern in Node.js RCE vulnerabilities like CVE-2026-30120.

Command

bash 
node -e "process.title='remotion-renderer'; const {execSync} = require('child_process'); execSync('whoami > /tmp/remotion_rce_test.txt');"

Cleanup

bash 
rm -f /tmp/remotion_rce_test.txt

Expected Telemetry

Process event for node with title 'remotion-renderer'. child_process module load. Execution of 'whoami'. File write to /tmp/remotion_rce_test.txt.

Expected Detection

Alert should fire on detection of 'remotion' in process context combined with 'child_process' and 'execSync' in command line arguments.

Test 3 Simulate Remotion RCE on Windows via spawnSync
windows

Windows equivalent simulation of CVE-2026-30120 exploitation using spawnSync to execute a system command from within a Remotion-referencing Node.js context.

Command

powershell 
node.exe -e "process.title='remotion-render'; const {spawnSync} = require('child_process'); spawnSync('cmd.exe', ['/c', 'whoami > %TEMP%\\remotion_rce_test.txt']);"

Cleanup

powershell 
del %TEMP%\remotion_rce_test.txt

Expected Telemetry

DeviceProcessEvents entry for node.exe with 'remotion' and 'spawnSync' in CommandLine. Child process event for cmd.exe spawned from node.exe. File write event for remotion_rce_test.txt in TEMP directory.

Expected Detection

Alert fires on node.exe CommandLine containing 'remotion' and 'spawnSync', with unexpected cmd.exe child process.

Related Detections

Tactic Hubs

TA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1059.007JavaScriptT1190Exploit Public-Facing ApplicationT1203Exploitation for Client Execution

Same Tactic: Execution

Popular Detections