VulnSocial

CVE-2026-94106Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-09-21); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-21: 2Mentions · 2026-10-31: 1Patch / Workaround · 2026-09-21: 2Technical Details · 2026-09-21: 2Technical Details · 2026-10-31: 109-2110-31
Signal classification2 categories
Patch
266.7%
Disclosure
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-212
Patch2
2026-10-311
Disclosure1
Full discourse3 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Disclosure

    CVE-2026-94106: OS command injection in getID3 before 1.9.26 lets crafted filenames run arbitrary commands. CVSS 8.8. No patch yet - review your exposure and restrict uploads now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94106/ #getID3 #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The tweet discloses CVE‑2026‑94106, an OS command injection in getID3 before version 1.9.26 that enables arbitrary command execution via crafted filenames (CVSS 8.8). It notes that no patch is yet available and urges organizations to review exposure and restrict uploads.

    0001055
    1.1K followersView on X
  • ThreatAft@ThreatAft
    Patch

    🚨 getID3 CVE-2026-94106 — CVSS 8.8 A crafted filename is enough. shell_exec() called WITHOUT escapeshellarg(). Affected: through 1.9.25 Fixed: 1.9.26 UPGRADE NOW. → https://threataft.com/articles/getid3-cve-2026-94106-os-command-injection-malicious-filenames #getID3 #CVE #RCE #PatchNow #CyberSecurity #ThreatIntel

    Post summary

    The tweet discloses CVE-2026-94106 in getID3, an OS command injection due to missing escapeshellarg() (CVSS 8.8), notes it is fixed in version 1.9.26, and urges immediate upgrade.

    0000057
    44 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-94106 (CVSS 8.8): getID3 <1.9.26 vulnerable to command injection via filenames. Update the library if present in your web or media apps. https://nvd.nist.gov/vuln/detail/CVE-2026-9410… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/6VFS51gPay

    Post summary

    CVE‑2026‑94106 (CVSS 8.8) is a command injection vulnerability affecting getID3 versions before 1.9.26 that can be triggered via malicious filenames; the advisory urges updating the library to mitigate the issue.

    0000045
    96 followersView on X

Explore more

Back to dashboard