Description
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-110649 ↗
- github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js ↗
- github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js ↗
- github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253 ↗
- github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bc ↗
- github.com/shahkashani/stills/pull/29 ↗
- github.com/shahkashani/stills/pull/30 ↗
- www.vulncheck.com/advisories/stills-before-25.24.2-os-command-injection-via-media-file-names ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.