CVE-2026-94106

High

Description

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

SeverityHigh

CVSS8.8

Exploit probability—

ProductJames-heinrich Getid3

PublishedSep 20, 2026

First seenSep 20, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

james-heinrich getid31.9.26 or later

Patches

github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6
github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4

Vendor advisories

github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx
github.com/JamesHeinrich/getID3/releases/tag/v1.9.26

Affected products

Product	Affected versions	Fixed in
james-heinrich getid3	v < 1.9.26	1.9.26

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.