CVE-2026-42846: ClipBucket: Remote Play URL Command Injection
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ClipBucketto a version that resolves this vulnerability.Fixed in 5.5.3 - #140
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42846?
The severity of CVE-2026-42846 is critical with a score of 9.8.
How do I fix CVE-2026-42846?
To fix CVE-2026-42846, upgrade ClipBucket to version 5.5.3 or later.
What is the impact of CVE-2026-42846?
CVE-2026-42846 allows remote command execution via crafted URLs due to OS command injection in ClipBucket.
Who is affected by CVE-2026-42846?
All authenticated users of ClipBucket version prior to 5.5.3 are affected by CVE-2026-42846.
What is the nature of the vulnerability in CVE-2026-42846?
CVE-2026-42846 is an OS command injection vulnerability in ClipBucket's Remote Play feature.