CVE-2026-77931
8.8HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- —
Impact
Remote attackers can execute arbitrary OS commands with host privileges by getting MoviePilot to process malicious untrusted content, such as poisoned torrent metadata or web search results. This requires user interaction or an automated flow that triggers processing of external attacker-controlled content.
Root cause
Untrusted external text can manipulate the model into invoking the unrestricted ExecuteCommandTool with confirm_dangerous set to true, bypassing command safety validation and passing malicious input directly to asyncio.create_subprocess_shell.
Affected systems
MoviePilot through 3.1.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to a version beyond 3.1.5 once available; until patched, disable automated web browsing, external searching, and torrent parsing features or restrict network access to the MoviePilot instance.
$ docker inspect --format '{{.Config.Image}}' $(docker ps -q -f ancestor=moviepilot) || docker ps | grep moviepilotAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.