CVE-2026-94106

getID3 before 1.9.26 is affected by an OS command injection vulnerability in its shell-out handlers, which fail to escape filenames when constructing command strings. An attacker can craft a malicious filename containing shell metacharacters to inject arbitrary commands that execute with the priv...