CVE-2026-42846

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3

Description The Remote Play feature in ClipBucket v5 allows authenticated users to import external URLs as video sources. The application concatenates these URLs directly into shell commands without proper escaping or sanitization. Consequently, an attacker can include shell metacharacters in the URL to execute arbitrary commands on the server with the privileges of the ClipBucket service.

Recommendations Update to version 5.5.3. As a temporary workaround, restrict access to the Remote Play feature to minimize the risk of exploitation.