CVE-2026-106057

HighCVSS 7.8

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Summary

patool before version 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.

Risk Assessment

An attacker could execute arbitrary commands on the system with patool process privileges, potentially leading to system compromise or data theft.

Recommendation

Update patool to version 4.0.6 or later, which includes a fix for this vulnerability.

Other vulnerabilities in patool

CVE-2026-29509Medium
Patool before version 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12. The vulnerability arises because the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check.

Original NVD description (English source)

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS