OS Command Injection in Stills before 25.24.2

Executive Summary

CVE-2026-110649 is an OS command injection vulnerability in Stills versions before 25.24.2. Attackers can execute shell commands by naming media files with $(...) or backticks. When ffmpeg, ffprobe, gifsicle, or convert processes these files, the injected commands run with Node.js process privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses stills versions before 25.24.2 by inspecting package.json or running npm list stills. Monitor file processing logs for ffmpeg, ffprobe, gifsicle, or convert commands with suspicious filenames containing $(...) or backticks. Use grep to search for these patterns in logs or command history.

Useful 0 Not Useful 0

Impact Analysis

If you use Stills with untrusted file sources (e.g., user uploads), attackers could execute arbitrary commands on your system. This could lead to data theft, system compromise, or further network infiltration, depending on the Node.js process privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized command execution on systems processing media files, potentially exposing sensitive data or violating data protection requirements. For GDPR, it may result in unauthorized access to personal data if attackers execute commands to exfiltrate files. For HIPAA, it could allow unauthorized access to protected health information if the system processes medical media files. The lack of input sanitization in file paths undermines secure data handling practices required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade stills to version 25.24.2 or later immediately. Review and sanitize all file paths passed to ffmpeg, ffprobe, gifsicle, or convert commands. Replace direct shell command interpolation with array-based argument lists using execFileSync instead of execSync.

Useful 0 Not Useful 0