CVE-2026-77931 Details

A command injection vulnerability has been identified in MoviePilot versions through 3.1.5. This vulnerability allows attackers to execute arbitrary operating system commands by embedding malicious instructions in untrusted content. This content is processed through various tools, such as 'browse_webpage', 'search_web', and torrent metadata parsers. The injected commands are then passed to the ExecuteCommandTool, which is unrestricted, via 'asyncio.create_subprocess_shell'. Exploitation involves crafting content that prompts the model to execute commands with the 'confirm_dangerous' flag enabled, bypassing the built-in command safety validation. The vulnerability takes advantage of the administrative context to achieve remote code execution on the host system.

It is recommended to make the 'execute_command', 'write_file', and 'edit_file' tools opt-in and off by default. Additionally, any interaction that involves external content should be treated as potentially unsafe, requiring human confirmation before executing commands. Implementing a sandboxed execution environment that does not have root access or direct host mounts, instead of running commands through 'asyncio.create_subprocess_shell' on the host, is also advised. Finally, an allowlist or out-of-band confirmation mechanism should be used instead of a model-controllable 'confirm_dangerous' flag.