CVE-2026-77931 is a high severity (CVSS 8.8) command injection in MoviePilot through version 3.1.5. Untrusted web or torrent content can steer the built-in AI agent into running shell commands under an admin context. We found no confirmed fixed version, so check the project for a patch and limit exposure.
What's affected
MoviePilot versions up to and including 3.1.5. Neither the record nor the VulnCheck advisory we fetched names a fixed version, so we cannot confirm one. Check the project's releases and issue tracker.
Severity note: the record scores this 8.8 under CVSS 3.1. VulnCheck lists high at 8.7 under CVSS 4.0. The record carries no weakness identifier, while VulnCheck classifies it as CWE-1427, improper neutralization of input used for LLM prompting. Both agree on high.
How to check if you're exposed
Look at your MoviePilot version in the web interface or your container tag, and treat anything at or below 3.1.5 as in range. Then review the configuration. Is the AI agent feature enabled, and does it have the web browsing, web search and torrent parsing tools turned on? Who can reach the web interface? An instance on a private network with the agent features off is in a very different position from an internet-facing one.
What to do now
- Check the MoviePilot project for a release after 3.1.5 and apply it when it addresses this issue.
- Until then, disable the AI agent and its command execution tool if you do not need them, or run the instance without access to sensitive hosts and networks.
- Do not expose the interface to the internet. Put it behind a VPN or an authenticating proxy.
- Run it as a non-root user in a container with limited mounts, so a command run by the agent cannot reach much.
- Rotate credentials stored on the host if you suspect misuse.
Why it matters
This is a prompt injection that ends in command execution. The weakness is tracked by VulnCheck as CWE-1427, input used for LLM prompting. The agent reads content it does not control, such as a web page, search results or torrent metadata, and that text can include instructions the model follows. One tool the model can call runs shell commands.
The advisory says two safeguards failed. A confirmation flag could be set by the model itself, and a denylist of dangerous commands did not hold. The tool also ran in the admin session's context. The lesson applies well beyond this project: when an agent has a shell tool, content it reads is effectively code. The record's KEV flag is false and no exploitation report was in the sources we fetched.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does the user have to do to be attacked?
The record sets user interaction to required, so the agent has to process the hostile content, for example while browsing or searching.
Is it enough to rely on the confirmation prompt?
The advisory says the model could set the dangerous-command confirmation itself, so no.
Sources
Last reviewed: 18 October 2026.
