Abhishek(@aacle_):My favorite bug class right now: **argument injection.** 🎯 Jellyfin had an unauthenticated endpoint that could turn FFmpeg into a file reader. 📍 `/Videos/{itemId}/stream` An unvalidated query parameter was passed straight into FFmpeg. The trick wasn't `;id` or shell injection. ❌ It was an `-vf drawtext` filter that made FFmpeg render `[/]etc[/]shadow` into the video response. 👀 ✅ No shell needed ✅ No semicolon 💀 Just argument injection.

Abhishek

@aacle_

Building @Vulncure ⚡| Helping founders fix vulnerabilities before hackers find them. Talk to me about: Bug Bounties, LLM Security & React.

Joined June 2017

292 Following 49.3K Followers

Abhishek@aacle_

2026.09.21 21:32

My favorite bug class right now: **argument injection.** 🎯 Jellyfin had an unauthenticated endpoint that could turn FFmpeg into a file reader. 📍 `/Videos/{itemId}/stream` An unvalidated query parameter was passed straight into FFmpeg. The trick wasn't `;id` or shell injection. ❌ It was an `-vf drawtext` filter that made FFmpeg render `[/]etc[/]shadow` into the video response. 👀 ✅ No shell needed ✅ No semicolon 💀 Just argument injection.