Critical RCE in Remotion npm Package via Code Injection (CVE-2026-30120)

Vulnerability Overview

CVE-2026-30120 is a critical remote code execution vulnerability (CVSS 9.8) in the Remotion npm package, classified under CWE-94: Improper Control of Generation of Code (Code Injection). The root cause is insufficient sanitisation of input that is subsequently evaluated as code, enabling an attacker to inject and execute arbitrary code within the host Node.js process. In environments where Remotion handles user-supplied or externally sourced data, a successful exploit yields full process-level code execution with no authentication required.

Affected Software

• Package: remotion (npm registry)
• Affected versions: all releases prior to 4.0.410
• Vendor: npm ecosystem

At the time of writing, no patched release date has been confirmed. Organisations running any remotion version below 4.0.410 in a server-side or CI/CD context should treat the package as actively exploitable.

Exploitation Status

A public proof-of-concept (PoC) has been released, disclosed on 15 June 2026. The existence of weaponisable public code materially lowers the barrier for exploitation — opportunistic attackers can adapt the PoC with minimal effort. Defenders should treat this as an active threat rather than a theoretical risk, prioritising detection and patching accordingly. The vulnerability has not yet appeared on CISA's Known Exploited Vulnerabilities (KEV) catalogue, but the CVSS 9.8 score and public PoC make rapid escalation likely.

Detection Coverage

Our detection ships query coverage across all major SIEM platforms:

• Microsoft Sentinel (KQL)
• Splunk (SPL)
• Elastic (EQL)
• IBM QRadar (AQL)
• Sumo Logic
• Google Chronicle (YARA-L)
• CrowdStrike (CQL)

The detection logic targets behavioural indicators consistent with code injection exploitation: anomalous child process spawning from Node.js processes associated with Remotion, unexpected outbound network connections initiated by the renderer process, and filesystem artefacts indicative of payload staging. Queries are tuned to surface exploitation attempts while suppressing noise from legitimate Remotion rendering workflows, focusing on process lineage and command-line argument patterns that deviate from expected Remotion operation.

Recommendations

• Upgrade remotion to version 4.0.410 or later immediately.
• Audit your dependency tree with npm audit or equivalent to identify transitive exposure.
• Restrict outbound network access from Remotion rendering processes where possible.
• Deploy the detections below and baseline normal Remotion process behaviour in your environment before the PoC is weaponised further.

Full detection queries for all seven SIEM platforms, ATT&CK technique mappings, and atomic test cases are available on the CVE-2026-30120 detection page. A purple team playbook covering adversary simulation and validation steps is available to subscribers.