CVE-2026-94106CWE-78command-injection

CVE-2026-94106

High · published September 20, 2026

CVSS v3.1
8.8
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01664 · 76.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-20T16:17Z
References (8)
https://github.com/JamesHeinrich/getID3 · [email protected]https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110 · [email protected]https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4 · [email protected]https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6 · [email protected]https://github.com/JamesHeinrich/getID3/issues/503 · [email protected]https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26 · [email protected]https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx · [email protected]https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 2%
    epss
  • 20 SEP 11:09Z
    getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
    cvelistv5