Command Injection Risk in MoviePilot by Lasso Security

CVE-2026-77931

What is CVE-2026-77931?

MoviePilot up to version 3.1.5 is susceptible to a command injection vulnerability that permits attackers to execute arbitrary operating system commands. This flaw arises when untrusted content is processed through tools such as browse_webpage, search_web, and torrent metadata parsers. These unvalidated inputs can be passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell, effectively allowing attackers to circumvent the validate_command_safety denylist. By manipulating the model into invoking execute_command with confirm_dangerous set to true, an attacker can exploit the context of an admin session, leading to remote code execution on the host system.

References