CVE WATCH / VULNERABILITY DETAIL
CVE-2026-110649
CRITICALCVSS 9.8NVD feed
Published 14 October 2026 · tracked since 15 October 2026
Description
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffpro
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-96615 MEDIUM 6.5
- CVE-2026-97205 HIGH 8.1
- CVE-2026-97629 MEDIUM 6.5
- CVE-2026-95101 MEDIUM 5.3
- CVE-2026-91184 HIGH 8.8
- CVE-2026-93479 HIGH 8.1
- CVE-2026-94197 HIGH 7.5
- CVE-2026-73800
- CVE-2026-73802
- CVE-2026-60021