CVE-2026-110649
Last modified
CVE-2026-110649 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.. EPSS estimates a 2.52% chance of exploitation in the next 30 days.
Description
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| shahkashani | stills | < 25.24.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-110649?
How severe is CVE-2026-110649?
How do I fix CVE-2026-110649?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110643transcribe2texts through 1.0.6 contains an OS command inject…9.8
- CVE-2026-110644nodejs-whisper through 0.3.1 contains an OS command injectio…9.8
- CVE-2026-110645Video-stitch before 2.0.0-beta.1 contains an OS command inje…9.8
- CVE-2026-110646Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS co…8.1
- CVE-2026-110647Turnpress through 0.4.2 contains an OS command injection vul…7.8
- CVE-2026-110648@offactory/compress-fonts before 1.1.1 contains an OS comman…7.8
- CVE-2026-11065Use after free in ANGLE in Google Chrome prior to 149.0.7827…9.6
- CVE-2026-110650The thumbnail Python package through 1.5 contains an OS comm…9.8
- CVE-2026-110652ONLYOFFICE DocumentServer before 10.0.0 contains an unauthen…4
- CVE-2026-110654libzvbi through 0.2.45 contains an out-of-bounds write vulne…6.1
- CVE-2026-110655miniupnpc through 2.3.3 contains a one-byte heap out-of-boun…3.1
- CVE-2026-110656miniupnpc through 2.3.3 contains a one-byte heap out-of-boun…3.1
Are you affected by CVE-2026-110649?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST