Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck
CVE-2026-106057patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt
High 7.8
In plain English
A high-severity OS command injection in patool from wummel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | patool | no fix listed | UBUNTU-CVE-2026-106057 |
| Ubuntu:24.04:LTS | patool | no fix listed | UBUNTU-CVE-2026-106057 |
| Ubuntu:26.04:LTS | patool | no fix listed | UBUNTU-CVE-2026-106057 |
| Ubuntu:26.10 | patool | no fix listed | UBUNTU-CVE-2026-106057 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- Patch Commit patch
- https://github.com/wummel/patool product
- https://github.com/wummel/patool/blob/4.0.5/patoolib/util.py#L110-L116 technical-description
- VulnCheck Advisory: patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt third-party-advisory