Josh HawkinsandGitHub cf418dd6b6
CI / AMD64 Build (push) Waiting to run
CI / ARM Build (push) Waiting to run
CI / Jetson Jetpack 6 (push) Waiting to run
CI / AMD64 Extra Build (push) Blocked by required conditions
CI / ARM Extra Build (push) Blocked by required conditions
CI / Synaptics Build (push) Blocked by required conditions
CI / Assemble and push default build (push) Blocked by required conditions
Restrict go2rtc ffmpeg and ngrok options without arbitrary exec (#24709)
* restrict go2rtc ffmpeg and ngrok options without arbitrary exec

The GO2RTC_ALLOW_ARBITRARY_EXEC checks only looked at go2rtc.streams, so an admin could save a config with a custom ffmpeg.bin or ngrok.command and run any command as the go2rtc user after a restart. go2rtc builds every ffmpeg: source into a command that starts with ffmpeg.bin, and it runs ngrok.command at startup. A custom template also brought back arbitrary ffmpeg arguments, since a stream can reference any template key with #video=<name>.

config/save and config/set now reject any added or changed key under go2rtc.ffmpeg or go2rtc.ngrok unless arbitrary exec is enabled. Keys already in the saved config are left alone, the same as stream sources. At startup, ffmpeg.bin is always Frigate's ffmpeg and ngrok is dropped unless arbitrary exec is enabled. Templates already in the config file, such as the documented vaapi global, keep working.

* reject ffmpeg paths with spaces, quotes or shell characters

ffmpeg.path was used as-is when absolute, and several ffmpeg commands are built as strings and split on spaces before running. A path like `/bin/sh -c <cmd>;#` ran a shell command instead of ffmpeg in the preview and export processes, and in go2rtc through the birdseye restream exec source. The path is now validated as a version alias or an absolute path of plain characters, so config/save and config/set reject an unsafe value. resolve_ffmpeg_path falls back to the default ffmpeg for one, and the go2rtc startup script prints an error.
2026-10-18 06:41:38 -10:00
2026-07-25 11:22:05 -06:00
2026-03-20 07:24:34 -06:00
2026-10-15 18:52:01 -04:00
2021-02-25 07:01:59 -06:00
2026-07-08 08:27:38 -05:00
2026-07-25 11:22:05 -06:00
2026-05-20 08:36:49 -06:00
2026-07-25 11:22:05 -06:00
2023-01-06 07:03:16 -06:00
2026-01-01 09:56:09 -06:00
2026-10-14 15:10:05 -04:00
2023-11-18 08:04:43 -06:00
2026-07-06 12:28:02 -05:00

logo

Frigate NVR™ - Realtime Object Detection for IP Cameras

License: MIT

Translation status

[English] | 简体中文

A complete and local NVR designed for Home Assistant with AI object detection. Uses OpenCV and Tensorflow to perform realtime object detection locally for IP cameras.

Use of a GPU or AI accelerator is highly recommended. AI accelerators will outperform even the best CPUs with very little overhead. See Frigate's supported object detectors.

  • Tight integration with Home Assistant via a custom component
  • Designed to minimize resource use and maximize performance by only looking for objects when and where it is necessary
  • Leverages multiprocessing heavily with an emphasis on realtime over processing every frame
  • Uses a very low overhead motion detection to determine where to run object detection
  • Object detection with TensorFlow runs in separate processes for maximum FPS
  • Communicates over MQTT for easy integration into other systems
  • Records video with retention settings based on detected objects
  • 24/7 recording
  • Re-streaming via RTSP to reduce the number of connections to your camera
  • WebRTC & MSE support for low-latency live view

Documentation

View the documentation at https://docs.frigate.video

Donations

If you would like to make a donation to support development, please use Github Sponsors.

License

This project is licensed under the MIT License.

  • Code: The source code, configuration files, and documentation in this repository are available under the MIT License. You are free to use, modify, and distribute the code as long as you include the original copyright notice.
  • Trademarks: The "Frigate" name, the "Frigate NVR" brand, and the Frigate logo are trademarks of Frigate, Inc. and are not covered by the MIT License.

Please see our Trademark Policy for details on acceptable use of our brand assets.

Screenshots

Live dashboard

Live dashboard

Streamlined review workflow

Streamlined review workflow

Multi-camera scrubbing

Multi-camera scrubbing

Built-in mask and zone editor

Built-in mask and zone editor

Translations

We use Weblate to support language translations. Contributions are always welcome.

Translation status

Copyright © 2026 Frigate, Inc.

Languages
Python 50.1%
TypeScript 48.6%
Shell 0.5%
CSS 0.3%
Dockerfile 0.2%
Other 0.1%