MoviePilot: Command injection via indirect prompt injection in AI assistant
Summary
MoviePilot through version 3.1.5 contains a command injection flaw in its AI assistant. Hidden instructions in web pages, search results or torrent metadata that an administrator asks the assistant to process can cause the model to call the execute_command tool, which runs OS commands on the host. The attack requires no direct access to the instance and no non-default configuration, and the commands run with the privileges of the MoviePilot process, which can be root.
Affected
- MoviePilot up to and including 3.1.5
- Deployments with the AI assistant and its web, search or torrent metadata tools enabled
Fixed in
Unknown. No vendor advisory or patched version was found. Check the project's release notes at https://github.com/jxxghp/MoviePilot for a fixed build.
Workaround
- Disable the AI assistant and its web and search tools if not needed
- Remove or disable the command execution tool (execute_command)
- Restrict who can access the instance
- Run the container with minimal privileges, no host mounts and no credentials beyond what is needed
Exploitation
- Exploitation status: no evidence of exploitation in the wild found; not listed in KEV
- Public proof of concept: none identified
- Technical impact rated total by CISA SSVC; automatable: no
Our recommendation
- Inventory all MoviePilot instances, including Docker images, and check their version and AI feature settings
- Disable the AI assistant and the command execution tool where they are not required
- Restrict network access to the instance and run it as non-root with minimal mounts
- Upgrade to a fixed version once the vendor publishes one and verify it against the project's release notes
- Monitor the host for unexpected child processes of the MoviePilot process
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Lasso Security: CVE-2026-77931 www.lasso.security
- VulnCheck Advisory: MoviePilot Command Injection via ExecuteCommandTool www.vulncheck.com
- VulDB: CVE-2026-77931 vuldb.com
- VulDB: Exploit status entry 420450 vuldb.com
- OpenCVE: CVE-2026-77931 app.opencve.io
- Write-up: MoviePilot lets the model decide whether a command was dangerous dev.to
- CVE JSON record (CVEProject cvelistV5) raw.githubusercontent.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:37.
Original description (NVD)
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.