Stills before 25.24.2 contains an OS command injection flaw that allows an attacker to execute arbitrary shell commands by inserting shell metacharacters such as $(…) or backticks into media file names. This injection occurs when the application passes the unvalidated file name directly to external utilities (ffmpeg, ffprobe, gifsicle, or convert) under Node.js process privileges, giving the attacker the opportunity to run any command on the host.

The vulnerability affects any installation of the Still application released prior to 25.24.2 on any supported platform. The command construction logic is identical across platforms, so every older release is susceptible if media file names are provided by untrusted users.

The CVSS score of 9.3 indicates a high severity flaw that delivers full remote code execution when the application accepts external media file names. The EPSS score of 3% reflects a modest likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. The most likely attack vector is through exposure to attacker‑supplied media, a common channel for applications that process uploaded or shared media files.