CVE-2026-77931

MoviePilot through version 3.1.5 is vulnerable to a command injection vulnerability. The root cause lies in the ExecuteCommandTool , which uses asyncio.create_subprocess_shell to execute commands without sufficient restriction. Attackers can embed malicious instructions in untrusted content proce...