CVE-2026-106057: patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed?
The issue affects patool versions before 4.0.6 on Windows. It applies to operations involving single-file archive formats that are run with shell=True.
What does an attacker need to exploit this?
An attacker needs to cause patool to process an archive filename they control or can influence. Crafted Windows command-shell metacharacters or embedded double quotes in that filename can result in command execution with the privileges of the patool process.
Are users required to take an action for exploitation?
Yes. The supplied CVSS vector includes user interaction, so exploitation requires a user to process the crafted filename with the affected patool workflow.
How can I determine whether I am affected?
Check whether patool is installed on Windows and whether its version is earlier than 4.0.6. Prioritize deployments that process untrusted or externally supplied filenames using single-file archive formats.