GHSA-gjx4-2c7g-fm94 · Severity: critical · Ecosystem: npm — screenshot-desktop vulnerable to command Injection via `format` option
screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary command execution with the privileges of the calling process. This vulnerability is fixed in 1.15.2.
Conclusion & alert: CVE-2025-55294 is rated Moderate Risk (64.8/100): CVSS Critical severity, with medium exploitation likelihood (EPSS 1.48%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.55% | 1.48% | +0.93% |
| 2 | 2026-05-15 | 0.48% | 0.55% | +0.07% |
| 3 | 2026-05-05 | — | 0.48% | — |
Full EPSS history (9 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
GHSA-gjx4-2c7g-fm94 · Severity: critical · Ecosystem: npm — screenshot-desktop vulnerable to command Injection via `format` option
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||