---
id: CVE-2026-94106
title: >-
  getID3 before 1.9.26 contains an OS command injection vulnerability in
  shell-out handlers that fail to escape filenames in command strings
summary: >-
  getID3 before 1.9.26 contains an OS command injection vulnerability in
  shell-out handlers that fail to escape filenames in command strings. Attackers
  can craft malicious filenames containing shell metacharacters to inject
  arbitrary comma…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: james-heinrich
product: getid3
affected:
  - getid3 < 1.9.26
published: '2026-09-20'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94106'
references:
  - url: 'https://github.com/JamesHeinrich/getID3'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/blob/fefffe762b02be155dcc32eec57feff8a49bc4b5/getid3/write.vorbiscomment.php#L85-L110
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/commit/2c6f3f96546f05746405872848114754ed7fe9b4
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6
    label: disclosure@vulncheck.com
  - url: 'https://github.com/JamesHeinrich/getID3/issues/503'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/JamesHeinrich/getID3/releases/tag/v1.9.26'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/getid3-before-1.9.26-os-command-injection-via-unescaped-filenames
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.01664
epssPercentile: 0.75715
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-21T16:42:44.502669Z'
ingestedAt: '2026-09-20T11:20:23.394Z'
---

## Overview

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.