Python CVE-2022-50919

CRITICAL

OS Command Injection (CWE-78)

2026-01-13 disclosure@vulncheck.com

RCE Python Tdarr

9.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

3

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 29, 2026 - 18:54 vuln.today

Public exploit code

CVE Published

Jan 13, 2026 - 23:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like --help; curl .py | python to execute remote code without authentication.

AnalysisAI

Tdarr 2.00.15 media transcoding server has unauthenticated RCE through command injection in the Help terminal. Commands can be chained without any input filtering. PoC available.

Technical ContextAI

The Help terminal passes input directly to a system shell (CWE-78) without sanitization. Commands can be chained using semicolons.

RemediationAI

Update Tdarr. Restrict web interface access.

More in Python

View all

CVE-2025-24016 CRITICAL Act Now POC

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t

CVE-2025-27520 CRITICAL Act Now POC

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser

CVE-2025-2945 CRITICAL Act Now POC

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi

CVE-2013-5093 MEDIUM This Month POC

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL Act Now POC

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica

CVE-2014-0224 HIGH Act Now POC

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2024-21644 HIGH Act Now POC

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.

CVE-2026-33017 CRITICAL Act Now POC

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301

CVE-2017-9462 HIGH Act Now POC

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse

CVE-2026-49869 CRITICAL Act Now POC

Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to

CVE-2026-39987 CRITICAL Act Now POC

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/

CVE-2024-21645 MEDIUM This Month POC

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne

Same weakness CWE-78 – OS Command Injection

View all

CVE-2019-15107 CRITICAL POC

CVE-2024-51378 CRITICAL POC

CVE-2014-6271 CRITICAL POC

CVE-2018-11138 CRITICAL POC

CVE-2014-6278 HIGH POC

CVE-2017-6334 HIGH POC

CVE-2024-50603 CRITICAL POC

CVE-2024-9474 MEDIUM POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2022-50919 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy