Read the docs
TI-2026-74143 Aliases CVE-2026-110649GHSA-53p6-95m7-9c4h

OS command injection in Stills via media file names

Priority MEDIUM 53CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Stills before 25.24.2 by shahkashani contains an OS command injection flaw (CWE-78) in how it handles media file paths. An unauthenticated remote attacker can name a media file with $(...) or backticks so that shell commands run with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert processes the file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02521 84th percentileScored 2026-11-07
Fix Fixed stills (shahkashani): 25.24.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shahkashanistillsbefore 25.24.225.24.2Patch availableCNA
  • stills Vendorshahkashani Affected before 25.24.2 Fixed in 25.24.2 Patch available CNA

Remediation

Update Stills to version 25.24.2, which is the fixed version listed for the affected package.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA stills (shahkashani) Fixed in 25.24.2

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-110649
  2. 2026-10-14 Alias added: GHSA-53p6-95m7-9c4h
  3. 2026-10-15 CISA SSVC decision points changed

References

Patch 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences