Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck
CVE-2026-110649Stills before 25.24.2 OS Command Injection via Media File Names
Critical 9.8
In plain English
A critical-severity OS command injection in stills from shahkashani. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.5%top 15.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| shahkashani | stills | 0 – before 25.24.2 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/shahkashani/stills/pull/29 patch, issue-tracking
- https://github.com/shahkashani/stills/pull/30 patch, issue-tracking
- https://github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bc patch
- https://github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253 patch
- https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js#L106-L108 technical-description
- https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js#L58-L60 technical-description
- VulnCheck Advisory: Stills before 25.24.2 OS Command Injection via Media File Names third-party-advisory