CVE-2026-110649 in stills
Summary
by MITRE • 10/14/2026
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Stills versions prior to 25.24.2 represents a critical OS command injection flaw that stems from improper neutralization of special elements used in operating system commands. This security defect allows an attacker with the ability to influence media file paths or names to execute arbitrary shell commands on the host system. The root cause lies in how the application processes input for external multimedia tools such as ffmpeg, ffprobe, gifsicle, and ImageMagick convert. When these utilities are invoked by Node.js process privileges, they often accept arguments that include filenames. If the software fails to properly sanitize or escape special shell metacharacters within these filenames before passing them to the underlying operating system command interpreter, it creates a vector for code execution.
Specifically, attackers can exploit this flaw by naming a media file using syntax such as $(...) or backticks (`). These constructs are interpreted by most Unix-like shells as command substitution operators. When the vulnerable version of Stills passes an unsanitized filename containing these characters to one of the supported multimedia processing tools, the shell interprets the content within the parentheses or backticks as a separate command to be executed. Consequently, any operating system commands embedded in the file name are run with the same privileges as the Node.js process running the application. This effectively bypasses standard access controls and allows for complete compromise of the underlying server environment if the service is running with elevated permissions.
The operational impact of this vulnerability is severe, potentially leading to full remote code execution (RCE). An attacker could use this entry point to install malware, exfiltrate sensitive data, pivot to other systems within the network, or disrupt services by terminating critical processes. Because Node.js applications often run as part of web servers or API endpoints, an unauthenticated attacker might exploit this vulnerability simply by uploading a maliciously named file through any interface that accepts media uploads and triggers processing via ffmpeg, ffprobe, gifsicle, or convert. This aligns with the Common Weakness Enumeration (CWE) standard under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. Furthermore, from a tactical perspective within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Execution techniques, allowing adversaries to establish persistence or escalate privileges depending on the context of the running process.
Mitigation strategies must focus on immediate patching and defensive coding practices. The primary remediation is to upgrade Stills to version 25.24.2 or later, where the developers have presumably implemented proper input validation and sanitization mechanisms. For environments where upgrading is not immediately feasible, defense-in-depth measures should be employed. This includes restricting file upload capabilities to authenticated users only, validating file extensions against a strict allowlist rather than relying on MIME types which can be spoofed, and ensuring that filenames are sanitized by removing or escaping special shell characters before being passed to external processes. Additionally, running the Node.js application with minimal required privileges reduces the blast radius of any successful exploitation attempt. Implementing input validation at multiple layers, including both client-side and server-side checks, further mitigates the risk of such injection attacks succeeding in production environments.