Skip to main content
cve.nowby Sazabi
← npm
npmPackage

remotion

2 known vulnerabilities (2 critical), with the versions each affects and the releases that fix them.

Latest release
4.0.541 (Nov 5, 2026): no advisory affects it
Newest unaffected release
4.0.541 (Nov 5, 2026), the latest release
Advisories
2 · 2 critical
Weekly downloads
3.3M
Dependents
212
Releases
500+ since 4.0.26 (Aug 27, 2023)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 2

  • CVE-2026-30121Critical 9.1

    remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.

    Affected: fixed in 4.0.410.

    Fixed in 4.0.410 (released Jan 26, 2026, 140 days before disclosure).

    The latest release, 4.0.541, is not affected.

    8.2% of remotion downloads last week were affected versions (290.6K).

  • CVE-2026-30120Critical 9.8

    remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.

    Affected: fixed in 4.0.410.

    Fixed in 4.0.410 (released Jan 26, 2026, 140 days before disclosure).

    The latest release, 4.0.541, is not affected.

    8.2% of remotion downloads last week were affected versions (290.6K).