Blake BlackshearandClaude Opus 5.5 12d9ab15c2 Restrict ffmpeg: go2rtc sources added through the API
go2rtc expands ffmpeg: sources into an exec: command line built from the
source's #key=value parameters, so the echo/expr/exec prefix check on
PUT /go2rtc/streams could be bypassed to run arbitrary ffmpeg arguments.

Sources submitted through the API now only accept the ffmpeg: parameters
the UI and docs use (video, audio, hardware with preset names, plus
numeric width/height/rotate/bitrate/timeout and async). Quotes,
whitespace, #raw, #input, #drawtext and unknown parameters are rejected
unless GO2RTC_ALLOW_ARBITRARY_EXEC is set. Sources defined in the config
file are unchanged.

Fixes GHSA-qjjw-3v66-279f

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 07:10:49 -05:00
2026-07-25 11:22:05 -06:00
2026-03-20 07:24:34 -06:00
2026-10-13 17:07:09 -06:00
2021-02-25 07:01:59 -06:00
2026-07-08 08:27:38 -05:00
2026-07-25 11:22:05 -06:00
2026-05-20 08:36:49 -06:00
2026-07-25 11:22:05 -06:00
2023-01-06 07:03:16 -06:00
2026-01-01 09:56:09 -06:00
2026-10-14 07:02:09 -05:00
2023-11-18 08:04:43 -06:00
2026-07-06 12:28:02 -05:00

logo

Frigate NVR™ - Realtime Object Detection for IP Cameras

License: MIT

Translation status

[English] | 简体中文

A complete and local NVR designed for Home Assistant with AI object detection. Uses OpenCV and Tensorflow to perform realtime object detection locally for IP cameras.

Use of a GPU or AI accelerator is highly recommended. AI accelerators will outperform even the best CPUs with very little overhead. See Frigate's supported object detectors.

  • Tight integration with Home Assistant via a custom component
  • Designed to minimize resource use and maximize performance by only looking for objects when and where it is necessary
  • Leverages multiprocessing heavily with an emphasis on realtime over processing every frame
  • Uses a very low overhead motion detection to determine where to run object detection
  • Object detection with TensorFlow runs in separate processes for maximum FPS
  • Communicates over MQTT for easy integration into other systems
  • Records video with retention settings based on detected objects
  • 24/7 recording
  • Re-streaming via RTSP to reduce the number of connections to your camera
  • WebRTC & MSE support for low-latency live view

Documentation

View the documentation at https://docs.frigate.video

Donations

If you would like to make a donation to support development, please use Github Sponsors.

License

This project is licensed under the MIT License.

  • Code: The source code, configuration files, and documentation in this repository are available under the MIT License. You are free to use, modify, and distribute the code as long as you include the original copyright notice.
  • Trademarks: The "Frigate" name, the "Frigate NVR" brand, and the Frigate logo are trademarks of Frigate, Inc. and are not covered by the MIT License.

Please see our Trademark Policy for details on acceptable use of our brand assets.

Screenshots

Live dashboard

Live dashboard

Streamlined review workflow

Streamlined review workflow

Multi-camera scrubbing

Multi-camera scrubbing

Built-in mask and zone editor

Built-in mask and zone editor

Translations

We use Weblate to support language translations. Contributions are always welcome.

Translation status

Copyright © 2026 Frigate, Inc.

Languages
Python 49.9%
TypeScript 48.7%
Shell 0.5%
CSS 0.3%
Dockerfile 0.2%
Other 0.2%