Vulnerability · Published Aug 19, 2025 · Assigned by GitHub_M
CVE-2025-55294Command Injection via `format` option in screenshot-desktop
Critical 9.8
In plain English
A critical-severity command injection in screenshot-desktop from bencevans. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary command execution with the privileges of the calling process. This vulnerability is fixed in 1.15.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | screenshot-desktop | 1.15.2 | GHSA-gjx4-2c7g-fm94 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bencevans | screenshot-desktop | < 1.15.2 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H