CVE-2026-77931
Deferred Deferred - Pending Action

Command Injection in MoviePilot

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-77931
EUVD
EUVD-2026-101806

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jxxghp MoviePilot 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MoviePilot through version 3.1.5 has a command injection vulnerability. Attackers can embed malicious OS commands in untrusted content processed by tools like browse_webpage, search_web, or torrent metadata parsers. These commands are passed to ExecuteCommandTool via asyncio.create_subprocess_shell, allowing arbitrary code execution on the host system.

Detection Guidance

Check MoviePilot logs for suspicious execute_command calls with confirm_dangerous=true. Monitor network traffic for unexpected subprocess_shell invocations. Review untrusted content processed by browse_webpage, search_web, or torrent parsers for command injection patterns like semicolons or backticks.

Impact Analysis

An attacker could exploit this to run unauthorized commands on your system, potentially stealing data, installing malware, or taking control of the host. Since it bypasses safety checks, even admin sessions are at risk of remote code execution.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks legal penalties and reputational damage.

Mitigation Strategies

Upgrade MoviePilot to version 3.1.6 or later. Disable or restrict access to ExecuteCommandTool. Implement input validation for all untrusted content. Disable admin session privileges for command execution. Monitor for unusual command activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77931. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart