Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.
CVSS 4.0CRITICAL 9.3·Network·No auth·No interaction·EPSS 0.02521·Published 2026-10-14·Fixed in 25.24.2CWE-78