High severity8.8NVD Advisory· Published Sep 20, 2026· Updated Sep 22, 2026
CVE-2026-94106
CVE-2026-94106
Description
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.9.26
Patches
Vulnerability mechanics
References
7- github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.phpnvd
- github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4nvd
- github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6nvd
- github.com/JamesHeinrich/getID3/issues/503nvd
- github.com/JamesHeinrich/getID3/releases/tag/v1.9.26nvd
- github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fxnvd
- www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenamesnvd
News mentions
0No linked articles in our index yet.