CVE-2026-94106

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.26

Description An OS command injection flaw exists in shell-out handlers that fail to properly escape filenames before incorporating them into command strings. Attackers can use filenames containing shell metacharacters—special characters that the system interprets as commands or operators—to execute arbitrary commands with the privileges of the process embedding getID3.

Recommendations Update to version 1.9.26 or later.