MGASA-2026-0504 Updated patool package fixes a security vulnerability

Patool 4.0.5 Path Traversal via safeextract Function. CVE-2026-29509...

Updated patool package fixes a security vulnerability

Patool 4.0.5 Path Traversal via safeextract Function. CVE-2026-29509...

Linux Distros Unpatched Vulnerability : CVE-2026-106057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double...

CVE-2026-106057

A flaw was found in patool. This vulnerability allows an attacker to execute arbitrary commands on Windows systems. The issue occurs because the utility fails to properly escape special characters and quotes in archive filenames before passing them to the command shell. By tricking a user or syst...

SUSE CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

Command Injection

Overview patool is a portable archive file manager Affected versions of this package are vulnerable to Command Injection via the shellquotent function in patoolib/util.py, which fails to escape Windows shell metacharacters such as ^, &, |, , ", ! and percent signs in arguments passed to shell...

ittup (>=1.1.0, <=1.13.0rc3), mangadownloadlib (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-106057 via patool (>=4.0.0, <=4.0.5)

patool PYPI version =4.0.0, =1.1.0, =1.0.0, =0.1.0, =0.20250314.0, =0.12.1, =0.14.12 Source cves: CVE-2026-106057 Source advisory: SNYK:PYTHON-PATOOL-20877495...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

UBUNTU-CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

ittup (>=1.1.0, <=1.13.0rc3), mangadownloadlib (>=1.0.0, <=1.0.1) +3 more potentially affected by CVE-2026-106057 via patool (>=4.0.0, <=4.0.5)

patool PYPI version =4.0.0, =1.1.0, =1.0.0, =0.1.0, =0.20250314.0, =0.12.1, =0.14.12 Source cves: CVE-2026-106057 Source advisory: MEND:CVE-2026-106057...

CVE-2026-106057

Versions of patool prior to 4.0.6 are vulnerable to an OS command injection vulnerability on Windows . The issue stems from the shell_quote_nt function failing to properly escape cmd.exe metacharacters or embedded double quotes within archive filenames. An attacker can exploit this by providing c...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

EUVD-2026-94305

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057: Improper Neutralization of Special Elements used in an OS Command

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

PT-2026-107482

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell quote nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to...

Fedora 46 : patool (2026-d38857d084)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d38857d084 advisory. Automatic update for patool-4.1.0-1.fc46. Changelog Sun Sep 13 2026 Federico Pellegrin - 4.1.0-1 - Bump to 4.1.0 rhbz2421500 and rhbz2508373 Tenable has...