short-drama-edit

The code is a video-editing utility, not evidently malware. It has a concrete path traversal risk because unvalidated CUT IDs form FFmpeg output filenames, and the concat listing also fails to escape paths for its parser. Restrict IDs to a safe filename character set, resolve and verify every output remains under the segment directory, and correctly escape concat-demuxer entries.