---
id: CVE-2026-110649
title: >-
  Stills before 25.24.2 contains an OS command injection vulnerability that
  allows attackers to execute shell commands by supplying crafted media file
  paths
summary: >-
  Stills before 25.24.2 contains an OS command injection vulnerability that
  allows attackers to execute shell commands by supplying crafted media file
  paths. Attackers can name a media file with $(...) or backticks to execute
  operating sys…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T18:17:35.793'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110649'
references:
  - url: >-
      https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js#L58-L60
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js#L106-L108
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bc
    label: disclosure@vulncheck.com
  - url: 'https://github.com/shahkashani/stills/pull/29'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/shahkashani/stills/pull/30'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/stills-before-25.24.2-os-command-injection-via-media-file-names
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.018Z'
---

## Overview

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.