MoviePilot CVE-2026-77931

Requires MoviePilot (through 3.1.5) to be deployed with its LLM agent features that ingest untrusted external content - specifically browse_webpage, search_web, or torrent metadata parsing - and the unrestricted ExecuteCommandTool (execute_command via asyncio.create_subprocess_shell) must be reachable by the agent. Exploitation is limited by the need for an admin to actually invoke the agent against attacker-controlled content (reflected as UI:P in the CVSS vector) and by the probabilistic nature of prompt injection: the model must be successfully coerced into setting confirm_dangerous=true to bypass the validate_command_safety denylist. The attacker needs no MoviePilot credentials, but privilege for the resulting command execution is inherited from the admin session's is_admin context.

Signals point to a genuine but conditionally-gated high-severity issue rather than a mass-exploitation emergency. The CVSS 4.0 base score of 8.7 is driven by total impact (VC:H/VI:H/VA:H) via network vector with low complexity and no attacker authentication (PR:N), reflecting that the malicious payload is planted in untrusted external content the attacker never needs an account to supply. The one gating factor in the vector is UI:P (passive user interaction): an admin must actually run MoviePilot's AI agent against attacker-controlled content for the injected instructions to reach ExecuteCommandTool. No EPSS score, SSVC decision, KEV listing, or POC indicator was provided in the input, so exploitation probability and automatability cannot be quantified from the data - treat the absence of these as missing data, not as evidence of low risk. The vulnerability class (CWE-1427, LLM prompt injection) means exploitation reliability depends on the model consistently obeying injected instructions to set confirm_dangerous=true and bypass validate_command_safety, which is inherently less deterministic than a memory-corruption exploit; this argues for a lower real-world hit rate than the raw score suggests. Net: a legitimate priority for anyone running MoviePilot with its AI/agent features enabled, but not an indiscriminately wormable internet-wide threat, and no public exploit has been confirmed.

An attacker publishes a webpage or seeds a torrent whose metadata embeds hidden instructions. When a MoviePilot admin uses the AI agent to browse_webpage, search_web, or parse that torrent metadata, the model is manipulated into calling execute_command with confirm_dangerous set to true, which bypasses the denylist and runs arbitrary OS commands on the host under the admin session's is_admin context. No public exploit code was identified at time of analysis, but the attack path is fully described in the advisory.