Vulnerabilities

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file…

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Node.js

Product

ImageMagick / Ghostscript / FFmpeg / libxml2, Node.js

CVSS

9.8

EPSS

0.025 (p85)

Exposure class

Developer platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-110649 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 23
   CVE NVD 17d ago

   @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell…

   CVSS 9.8 CVE-2026-110639 Node.js
2. 23
   CVE NVD 17d ago

   git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to…

   CVSS 9.8 CVE-2026-110634 Node.js