OS Command Injection Vulnerability in getID3 Affected by Filenames Handling

CVE-2026-94106

What is CVE-2026-94106?

The getID3 library prior to version 1.9.26 suffers from an OS command injection vulnerability. This issue arises from improper handling of filenames in command strings, allowing attackers to inject arbitrary commands. By crafting malicious filenames containing shell metacharacters, a malicious actor could execute commands with the same privileges as the process that embeds the getID3 library. The flaw highlights the necessity of ensuring all user inputs are properly escaped to mitigate risks associated with command executions.

References