by Kastro
Paper/Archive/CVE-2026-42846

CVE-2026-42846

MacWarrior clipbucket-v5 — ClipBucket: Remote Play URL Command Injection

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.2.542 × 2010.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.

Affected

ProductAffectedFixed inSource
clipbucket-v5< 5.5.3 - #140–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/MacWarrior/clipbucket-v5/security/advisories/GHSA-hvfx-hxmr-28c7