9.8
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
Засегнати продукти
- shahkashani stills: преди 25.24.2
Вид слабост
История
- 14 октомври 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-110649
- https://nvd.nist.gov/vuln/detail/CVE-2026-110649
- https://github.com/shahkashani/stills/pull/29
- https://github.com/shahkashani/stills/pull/30
- https://github.com/shahkashani/stills/commit/5694b3b0dcd2da342f4f0497244129d4c9eb73bc
- https://github.com/shahkashani/stills/commit/51ba953983ba99915331607bf8530e6089952253
- https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/stills/frames.js#L106-L108
- https://github.com/shahkashani/stills/blob/66d5def1265b817d84524473a2813e4781dcbd80/lib/content/video.js#L58-L60
- https://www.vulncheck.com/advisories/stills-before-25.24.2-os-command-injection-via-media-file-names