Stills: OS command injection via crafted media file names

Summary

The npm library stills before 25.24.2 contains an OS command injection flaw in how it handles media file names. An attacker who can create a media file whose name contains $(...) or backticks can execute operating system commands with the privileges of the Node.js process when ffmpeg, ffprobe, gifsicle or convert runs. The CNA rates the issue 9.3 (Critical) under CVSS 4.0 and no authentication is required, but exposure depends on whether a service built on stills processes files that outside parties can place.

Affected

• stills 0 to before 25.24.2 (CNA range)
• VulDB additionally lists 25.24.0 and 25.24.1 as affected
• Default configuration: unaffected (per CNA)

Fixed in

• Upgrade to stills 25.24.2 or later
• 25.24.1 is incomplete and must be treated as vulnerable

Workaround

• No vendor workaround documented; the vendor's stated mitigation is to upgrade to 25.24.2
• Do not pass untrusted media files to stills
• Restrict write access to media and sync folders

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total
• No evidence of in-the-wild exploitation found; CISA KEV status unverified
• No public exploit found (VulDB: no available exploit)

Our recommendation

• Run npm ls stills across all projects and Node applications and check for versions below 25.24.2
• Upgrade to 25.24.2 or later and verify that no 25.24.1 installs remain
• Prioritise high if the library runs in an internet-facing upload pipeline, medium if only trusted internal media is processed
• Limit write access to processed media folders and run the process with least privilege or in a container
• Monitor for unexpected child processes spawned by Node.js

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory: Stills before 25.24.2 OS Command Injection via Media File Names www.vulncheck.com
• GitHub pull request #30 (stills) github.com
• Fix commit 51ba953 github.com
• Fix commit 5694b3b github.com
• VulDB entry 419993 vuldb.com
• OSV entry CVE-2026-110649 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:02.