ClipBucket: Remote Play URL Command Injection
CVE-2026-42846

9.8CRITICAL

Key Information:

Vendor

Macwarrior

Status
Clipbucket-v5
Vendor
CVE Published:
11 June 2026

What is CVE-2026-42846?

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.

Affected Version(s)

clipbucket-v5 < 5.5.3 - #140

References

https://github.com/MacWarrior/clipbucket-v5/security/advi...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.