CVE-2026-110649
Stills before 25.24.2 OS Command Injection via Media File Names
shahkashani stills
CVSS
9.3CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)2.52%Chance of exploitation activity in the next 30 days, higher than 84% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 25.24.2stillsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
Text from CVE List
Affected versions 1
- stillsaffected: all versions before 25.24.2CVE List
References 7
- github.com/shahkashani/stills/pull/29Fixvia CVE List
- github.com/shahkashani/stills/pull/30Fixvia CVE List
- github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bcFixvia CVE List
- github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253Fixvia CVE List
- vulncheck.com/advisories/stills-before-25.24.2-os-command-injection-via-media-file-namesAdvisoryvia CVE List
- github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js#L106-L108Referencevia CVE List
- github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js#L58-L60Referencevia CVE List