OS Command Injection Vulnerability in Patool by Wummel

CVE-2026-106057

What is CVE-2026-106057?

Patool, the archiving tool maintained by Wummel, is susceptible to an OS command injection flaw on Windows systems due to improper handling of shell metacharacters within filenames. Specifically, the function responsible for escaping these characters, shell_quote_nt, can be tricked by maliciously crafted filenames, such as report&calc.gz. When such a file is processed with shell=True, attackers can execute arbitrary commands with the privileges of the Patool process, potentially compromising system security. Users are urged to upgrade to version 4.0.6 or later to mitigate this vulnerability.

References