Stills
Monthly
OS command injection in Stills (shahkashani/stills), a Node.js media-processing library, before version 25.24.2 allows crafted media file names containing shell command-substitution syntax such as $(...) or backticks to be executed as operating system commands with the privileges of the Node.js process. The flaw is reachable whenever the library shells out to ffmpeg, ffprobe, gifsicle, or convert on an attacker-influenced path, and the CVSS 4.0 vector (9.3) describes an unauthenticated, low-complexity network attack (PR:N/UI:N) yielding high confidentiality, integrity, and availability impact; our independent assessment scores it CVSS:3.1 8.8/9.8-class (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) but cautions that real-world risk is materially lower in deployments where media file names are operator- or system-generated rather than user-supplied. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (25.24.2, via PRs #29/#30 and associated commits) is available.
OS command injection in Stills (shahkashani/stills), a Node.js media-processing library, before version 25.24.2 allows crafted media file names containing shell command-substitution syntax such as $(...) or backticks to be executed as operating system commands with the privileges of the Node.js process. The flaw is reachable whenever the library shells out to ffmpeg, ffprobe, gifsicle, or convert on an attacker-influenced path, and the CVSS 4.0 vector (9.3) describes an unauthenticated, low-complexity network attack (PR:N/UI:N) yielding high confidentiality, integrity, and availability impact; our independent assessment scores it CVSS:3.1 8.8/9.8-class (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) but cautions that real-world risk is materially lower in deployments where media file names are operator- or system-generated rather than user-supplied. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (25.24.2, via PRs #29/#30 and associated commits) is available.