CVE-2026-42846 ClipBucket: Remote Play URL Command Injection
Authenticated users can execute arbitrary commands via shell metacharacters in the Remote Play URL field of ClipBucket.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-42846?
CVE-2026-42846 is a critical command injection vulnerability in MacWarrior clipbucket-v5, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.
Weakness: CWE-78
Which versions are affected by CVE-2026-42846?
How do I fix CVE-2026-42846?
No fix has been published for CVE-2026-42846 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-42846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42846 exists.