Vendor
Stills versions prior to 25.24.2 are vulnerable to OS command injection via crafted media file paths containing shell metacharacters, enabling arbitrary command execution with Node.js process privileges.