External risk intelligence

Stills OS Command Injection via Crafted Media File Paths

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-110649

The vulnerability exists in a Node.js library used for media processing. While it processes file paths that could originate from user input in web applications, it is a library rather than a standalone network service. Its exposure depends entirely on how a developer integrates it into their specific application, making public reachability possible but not inherent to the product's deployment pattern.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a command injection flaw in media processing within a Node.js library, allowing attackers to execute system commands by naming media files in a specific way. The main concern is confirming if and how this library is used within our systems to understand potential exposure.

Media processing code can run unauthorized commands.
Leadership should remember potential for unauthorized system commands.
Confirm library usage and assess any associated risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by providing specially crafted media file names that contain shell commands, typically enclosed in `$(...)` or backticks. When the application processes these file names with tools like ffmpeg, ffprobe, gifsicle, or convert, the embedded commands are executed with the privileges of the Node.js process. This could allow an attacker to compromise the server by running arbitrary operating system commands.

No special access needed.
Crafted media file names trigger execution.
Risk of arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability exists that could allow attackers to execute arbitrary operating system commands. This could occur when the system processes specially crafted media file paths, potentially leading to unauthorized command execution with the privileges of the Node.js process.

System commands and file access.
Crafted media file paths.
Unauthorized command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS command injection vulnerability in Stills could be exploited by attackers to execute arbitrary shell commands. Teams responsible for applications that process media files using this library should prioritize identifying all instances of the affected technology, assessing their reachability and business criticality, and confirming ownership. Remediation planning should be risk-based, considering factors like exposure and potential impact.

Application owners should own the remediation effort.
Verify all deployments and user-input file path handling.
Plan coordinated remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Stills?

Stills is a Node.js library designed for media processing tasks, such as generating frames from video files. Developers use it to automate the handling and transformation of media assets within their own applications, often relying on underlying system tools like ffmpeg, ffprobe, gifsicle, or ImageMagick's convert to perform the heavy lifting of image and video manipulation.

What does CVE-2026-110649 mean for security?

This CVE describes an OS command injection vulnerability, classified as CWE-78. It means the software does not properly sanitize input when handling file names. An attacker can craft a file path containing shell syntax—like $(...) or backticks—that forces the server to execute unintended operating system commands with the same permissions as the application's Node.js process.

How is this vulnerability triggered?

An attacker triggers this by providing a file path containing malicious shell commands to an application using the affected Stills library. It is important to note that the vulnerability is not triggered by the content inside the media file itself, but specifically by the name given to the file. If the application logic does not use these specific processing tools or sanitize the naming input, the injection cannot occur.

Who should be concerned about this flaw?

According to Halo Surface Signal, risk is not inherent to the software itself but depends on how your developers integrated Stills into your applications. You should care if your systems allow user-supplied media files to be processed by the library. If an application is internet-facing and accepts file uploads or external media paths, the risk of external reachability increases significantly.

What steps should I take if I use Stills?

Your first step is to audit your application portfolio to locate all instances where this library is utilized. Focus specifically on code paths that handle file naming or user-provided media inputs. Once identified, evaluate the necessity of updating to version 25.24.2 or later, and work with your development teams to implement rigorous input validation for all file system operations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.