MGASA-2026-0504 Updated patool package fixes a security vulnerability

Patool 4.0.5 Path Traversal via safeextract Function. CVE-2026-29509...

Updated patool package fixes a security vulnerability

Patool 4.0.5 Path Traversal via safeextract Function. CVE-2026-29509...

Linux Distros Unpatched Vulnerability : CVE-2026-106057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double...

CVE-2026-106057

A flaw was found in patool. This vulnerability allows an attacker to execute arbitrary commands on Windows systems. The issue occurs because the utility fails to properly escape special characters and quotes in archive filenames before passing them to the command shell. By tricking a user or syst...

SUSE CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

ittup (>=1.1.0, <=1.13.0rc5), mangadownloadlib (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-106057 via patool (>=4.0.0, <=4.0.5)

patool PYPI version =4.0.0, =1.1.0, =1.0.0, =0.1.0, =0.20250314.0, =0.12.1, =0.14.12 Source cves: CVE-2026-106057 Source advisory: SNYK:PYTHON-PATOOL-20877495...

Command Injection

Overview patool is a portable archive file manager Affected versions of this package are vulnerable to Command Injection via the shellquotent function in patoolib/util.py, which fails to escape Windows shell metacharacters such as ^, &, |, , ", ! and percent signs in arguments passed to shell...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

UBUNTU-CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057

Versions of patool prior to 4.0.6 are vulnerable to an OS command injection vulnerability on Windows . The issue stems from the shell_quote_nt function failing to properly escape cmd.exe metacharacters or embedded double quotes within archive filenames. An attacker can exploit this by providing c...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

EUVD-2026-94305

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

ittup (>=1.1.0, <=1.13.0rc5), mangadownloadlib (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-106057 via patool (>=4.0.0, <=4.0.5)

patool PYPI version =4.0.0, =1.1.0, =1.0.0, =0.1.0, =0.20250314.0, =0.12.1, =0.14.12 Source cves: CVE-2026-106057 Source advisory: MEND:CVE-2026-106057...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

PT-2026-107482

Name of the Vulnerable Software and Affected Versions patool versions prior to 4.0.6 Description An OS command injection issue exists on Windows when the shell quote nt function fails to properly escape cmd.exe metacharacters or embedded double quotes within archive filenames. This allows attacke...

CVE-2026-106057: Improper Neutralization of Special Elements used in an OS Command

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

Fedora 44 : patool (2026-23dc582dae)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-23dc582dae advisory. Bump to 4.1.0 rhbz2421500 and rhbz2508373 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...