Vulnerability Description
getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/JamesHeinrich/getID3
- https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49
- https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754e
- https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703
- https://github.com/JamesHeinrich/getID3/issues/503
- https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26
- https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx
- https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-v
FAQ
What is CVE-2026-94106?
CVE-2026-94106 is a vulnerability with a CVSS score of 8.8 (HIGH). getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell met...
How severe is CVE-2026-94106?
CVE-2026-94106 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-94106?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.