CVE-2026-110649

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Remote unauthenticated attackers can execute arbitrary OS commands with Node.js process privileges. They just need to provide a crafted media filename containing shell substitution syntax.

Root cause

Media file paths are concatenated directly into shell executions for ffmpeg, ffprobe, gifsicle, or convert without sanitization.

Affected systems

Stills before 25.24.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Stills to version 25.24.2 or higher. As an interim workaround, sanitize incoming filenames to strip or reject characters like '$', '`', and parenthesis before passing them to the application.

shell

$ npm install stills@^25.24.2

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110649