files.photo.gallery command injection

Description

A command injection vulnerability in the video thumbnail rendering component of files.photo.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.3.0, <= 0.11.0

References

• GHSA-5wjw-qjhm-v43h
• CVE-2024-53615
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Command injection in github-todos - CVE-2021-44684
• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code - CVE-2026-46580
• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion - CVE-2026-46580
• [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-core - CVE-2026-46580

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

files.photo.gallery