CVE-2026-110649: falha crítica em shahkashani stills
Stills before 25.24.2 OS Command Injection via Media File Names
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 2.5%
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
shahkashani · stillsReferências
https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js#L58-L60https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js#L106-L108https://github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253https://github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bchttps://github.com/shahkashani/stills/pull/29https://github.com/shahkashani/stills/pull/30https://www.vulncheck.com/advisories/stills-before-25.24.2-os-command-injection-via-media-file-names