CVE-2026-77931 in MoviePilot
Summary
by MITRE • 10/15/2026
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in MoviePilot versions through 3.1.5 represents a critical command injection flaw rooted in the improper handling of untrusted input within an AI-driven automation framework. The core issue lies in how user-supplied content, such as web page data retrieved via browse_webpage or search results from search_web, is processed and subsequently fed into large language model interactions. These inputs are not sufficiently sanitized before being used to generate commands that interact with the underlying operating system. Specifically, the application utilizes an unrestricted ExecuteCommandTool which leverages asyncio.create_subprocess_shell to execute shell commands. This method of execution inherently poses significant risks because it passes strings directly to a shell interpreter without adequate validation or sandboxing mechanisms in place for dynamic content generated by AI models.
Attackers can exploit this flaw by crafting malicious content that manipulates the language model into invoking the execute_command function with specific parameters designed to bypass security controls. By embedding instructions within untrusted data processed through tools like torrent metadata parsers, an attacker can trick the system into setting confirm_dangerous to true. This parameter effectively disables or circumvents the validate_command_safety denylist, which is intended to block known malicious commands. Furthermore, because these operations occur within the context of an active admin session where the is_admin flag is set to true, the executed commands inherit full administrative privileges on the host system. This combination allows for remote code execution with elevated permissions, giving the attacker complete control over the affected server or workstation.
The operational impact of this vulnerability is severe, as it enables arbitrary command execution that can lead to data exfiltration, installation of persistent backdoors, lateral movement within a network, and total compromise of the host environment. Since MoviePilot often runs with elevated privileges to manage media libraries and system configurations, the potential for widespread damage increases significantly. The vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter where attackers use shell commands to execute malicious payloads, and potentially T1620 Reflection Evasion if the attack involves manipulating AI outputs to avoid detection by security monitoring tools.
Mitigation strategies must focus on immediate remediation of the codebase alongside broader architectural improvements. The most effective solution is to upgrade MoviePilot to a version where this vulnerability has been patched, ensuring that input validation and output encoding are strictly enforced for all data passed to shell execution functions. Developers should replace asyncio.create_subprocess_shell with subprocess.run or similar methods that do not invoke a shell interpreter unless absolutely necessary, thereby reducing the attack surface. Additionally implementing strict allowlists for permitted commands rather than relying on denylists can prevent bypasses like those exploited by setting confirm_dangerous to true. Input sanitization must be applied at multiple layers including before data enters the AI model context and after it is generated but before execution. Regular security audits and penetration testing focused on AI integration points are recommended to identify similar flaws in other components of the application infrastructure.