Critical severity9.8OSV Advisory· Published Aug 19, 2025· Updated Apr 15, 2026

CVE-2025-55294

Description

screenshot-desktop allows capturing a screenshot of your local machine. This vulnerability is a command injection issue. When user-controlled input is passed into the format option of the screenshot function, it is interpolated into a shell command without sanitization. This results in arbitrary command execution with the privileges of the calling process. This vulnerability is fixed in 1.15.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
screenshot-desktopnpm	< 1.15.2	1.15.2

Affected products

Bencevans/Screenshot DesktopOSV
Range: v1.0.0, v1.1.0, v1.10.0, …
ghsa-coords
pkg:npm/screenshot-desktop
Range: < 1.15.2

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-gjx4-2c7g-fm94ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-55294ghsaADVISORY
github.com/bencevans/screenshot-desktop/commit/59c87b0c175eec76090e6ccde313f4fc5d569b78nvdWEB
github.com/bencevans/screenshot-desktop/security/advisories/GHSA-gjx4-2c7g-fm94nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000