Key points
- MoviePilot versions up to 3.1.5 contain a command injection vulnerability rated high severity.
- Attackers can execute arbitrary OS commands by embedding malicious instructions in untrusted content.
- No official fix or update has been confirmed by the vendor for this issue.
MoviePilot versions through 3.1.5 are affected by a command injection vulnerability that allows remote code execution. The National Vulnerability Database rates this flaw as high severity with a CVSS score of 8.7. Attackers can exploit this by embedding malicious instructions in untrusted content processed by the application. This issue impacts the jxxghp MoviePilot software specifically.
In plain English
The vulnerability exists because MoviePilot passes untrusted data directly to a system command tool. When the application processes content through features like browse_webpage or torrent metadata parsers, it can trigger arbitrary OS commands. This happens via asyncio.create_subprocess_shell without proper sanitization. The flaw allows attackers to bypass safety checks and run code on the host machine.
The background
This issue is classified under CWE-1427 in the NVD record for CVE-2026-77931. The attack vector involves crafting content that instructs the underlying model to invoke a dangerous command execution tool. By setting confirm_dangerous to true, attackers bypass the validate_command_safety denylist. They then leverage the admin session's is_admin context to achieve full remote code execution on the host system.
What changes now
Security teams must assess their exposure to this command injection flaw immediately. Since no patch has been confirmed, organizations should verify if they are running MoviePilot version 3.1.5 or earlier. If affected, teams should consider isolating these systems from untrusted networks. Monitoring for unusual subprocess activity is also recommended while a vendor fix is awaited.
Who needs to act first
Teams should prioritize updating systems that process untrusted external content first. Check whether your deployment handles public torrent metadata or web searches. Roll out any mitigations in a test environment before production. Back up configurations before making changes. If no fix exists, reduce exposure by restricting network access to the affected service. Monitor logs for suspicious command execution patterns closely.
What to do and how to stay safe: MoviePilot
- Verify if your environment runs MoviePilot version 3.1.5 or earlier and isolate affected instances.
- Restrict network access to limit exposure to untrusted content sources like public torrents.
- Monitor system logs for unauthorized subprocess execution or unexpected command activity.
- Wait for an official vendor update before applying any unverified patches or workarounds.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-77931?
The National Vulnerability Database rates this flaw as high severity with a CVSS score of 8.7.
Which versions of MoviePilot are affected?
MoviePilot versions through 3.1.5 are affected by this command injection vulnerability.
Is there a patch available for this issue?
No official fix or update has been confirmed by the vendor for this vulnerability yet.
