{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/moviepilot/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:moviepilot:moviepilot:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-77931"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MoviePilot (\u003c= 3.1.5)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","command-injection","cve-2026-77931"],"_cs_type":"advisory","_cs_vendors":["MoviePilot"],"content_html":"\u003cp\u003eMoviePilot through version 3.1.5 contains a critical command injection vulnerability. The flaw exists within the application's handling of untrusted content, specifically during tasks involving web browsing, searching, or parsing torrent metadata. The application utilizes a tool named ExecuteCommandTool, which passes inputs to the \u003ccode\u003easyncio.create_subprocess_shell\u003c/code\u003e function in Python. Attackers can embed malicious instructions within untrusted data that trick the system into invoking this tool. Furthermore, the vulnerability includes a logic flaw in the command safety validation mechanism, where an attacker can set \u003ccode\u003econfirm_dangerous\u003c/code\u003e to true to bypass the denylist. If the application is running in an environment with an active admin session, the attacker can leverage the \u003ccode\u003eis_admin\u003c/code\u003e context to execute arbitrary OS commands on the host machine. This poses a significant risk to the integrity and confidentiality of the host environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the privileges of the MoviePilot service process. This can lead to full system compromise, data exfiltration, and lateral movement within the network. This vulnerability affects all MoviePilot deployments running version 3.1.5 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch all instances of MoviePilot by upgrading to the latest version that remediates CVE-2026-77931.\u003c/li\u003e\n\u003cli\u003eImplement strict network egress filtering for the container or server running MoviePilot to prevent reverse shell callbacks.\u003c/li\u003e\n\u003cli\u003eEnsure the MoviePilot service runs with the least privilege necessary, specifically avoiding execution as the root user.\u003c/li\u003e\n\u003cli\u003eAudit logs for anomalous subprocess execution patterns, particularly those originating from the MoviePilot process tree involving \u003ccode\u003esh\u003c/code\u003e or \u003ccode\u003ebash\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-15T02:34:34Z","date_published":"2026-10-15T02:34:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-moviepilot-cmd-injection/","summary":"MoviePilot versions through 3.1.5 are vulnerable to command injection via the ExecuteCommandTool, allowing unauthenticated or low-privileged actors to achieve remote code execution.","title":"Command Injection in MoviePilot","url":"https://feed.craftedsignal.io/briefs/2026-10-moviepilot-cmd-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - MoviePilot","version":"https://jsonfeed.org/version/1.1"}