Vulnerability · Published Jun 11, 2026 · Assigned by GitHub_M
CVE-2026-42846ClipBucket: Remote Play URL Command Injection
Critical 9.8
In plain English
A critical-severity OS command injection in clipbucket-v5 from MacWarrior. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpreted. This results in arbitrary command execution. This issue has been patched in version 5.5.3 - #140.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MacWarrior | clipbucket-v5 | < 5.5.3 - #140 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H