CVE-2026-77931 | jxxghp MoviePilot up to 3.1.5 Torrent Metadata Parser asyncio.create_subprocess_shell confirm_dangerous os command injection

SecurityVulns
Yanac

A vulnerability, which was classified as critical, has been found in jxxghp MoviePilot up to 3.1.5. The impacted element is the function asyncio.create_subprocess_shell of the component Torrent Metadata Parser. The manipulation of the argument confirm_dangerous leads to os command injection.

This vulnerability is traded as CVE-2026-77931. It is possible to initiate the attack remotely. There is no exploit available.VulDB Recent EntriesRead More