Description

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:18.650Z",
  "pubdate": "2026-10-14T15:17:18.650Z",
  "executiveSummary": "Stills versions prior to 25.24.2 contain a critical OS command injection vulnerability. This flaw allows an authenticated or unauthenticated attacker, depending on the application context, to execute arbitrary shell commands with the privileges of the underlying Node.js process.\nThe vulnerability stems from the improper sanitization of media file paths before they are passed to external system utilities, specifically ffmpeg, ffprobe, gifsicle, and convert. By crafting a filename containing shell metacharacters such as $(...) or backticks, an attacker can manipulate the command line arguments passed to these binaries.\nSuccessful exploitation enables remote code execution (RCE) on the host system. Given that the commands run with the same privileges as the Node.js process, an attacker could potentially gain full control over the application environment, exfiltrate sensitive data, or move laterally within the infrastructure.\nRisk implications are high, as the vulnerability is trivial to exploit if an attacker can influence the naming of files processed by the application. Organizations utilizing Stills should prioritize updating to version 25.24.2 or later immediately to mitigate this exposure.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located within the file processing pipeline of Stills. The root cause is the insecure concatenation of user-provided input—specifically media file paths—into command strings executed via shell contexts using utilities like ffmpeg, ffprobe, gifsicle, or convert.\nWhen Stills processes a media file, it invokes these external tools to perform operations such as transcoding, metadata extraction, or image manipulation. The application fails to properly escape or sanitize the file path string before passing it as a command-line argument to these utilities.\nAn attacker can exploit this by renaming a malicious or benign media file to include shell execution syntax. For example, by naming a file 'image$(whoami).jpg' or 'file`command`.jpg', the attacker forces the operating system to interpret the content within the special characters as a separate shell command. When the application invokes the external utility with this file path, the shell environment executes the injected command prior to or alongside the intended tool execution.\nThe attack flow follows these steps: 1) The attacker uploads or provides a reference to a file with a maliciously crafted filename containing shell metacharacters. 2) The application identifies the need to process the file using an external binary. 3) The application constructs a shell command string incorporating the malicious path without adequate input validation or parameterization. 4) The Node.js process triggers the execution of the command string in a shell-enabled environment. 5) The shell interprets the metacharacters, executing the injected commands with the full privileges of the Node.js process. 6) The results of the injected command may be returned to the attacker or silently executed in the background, allowing for reconnaissance, reverse shell establishment, or data exfiltration.\nThe vulnerability affects all versions of Stills prior to 25.24.2. Because the execution occurs within the context of the Node.js runtime, there are no specific authentication or privilege requirements beyond the ability to trigger the file processing routine. The impact is significant, as it grants the attacker code execution capabilities on the host operating system, effectively bypassing application-layer security controls."
}