capcut-edit

The script’s intended function is to cut a CapCut project and add title and CTA overlays. The main security issue is command-code injection: the user-controlled out path is interpolated into JavaScript executed by node -e, allowing crafted input to execute Node.js code with the script’s privileges. The unescaped final output can also produce invalid JSON; no network activity, credential theft, or other explicit malware behavior appears in this fragment. Severity is high when out can be attacker-controlled; review or replace the interpolation before use with untrusted arguments.