CVE-2026-106057

Summary

The patool library contains a command injection vulnerability in its Windows shell quoting implementation, allowing attackers to execute arbitrary commands when processing specially crafted archive filenames. This affects systems that use patool with shell=True parameter and can lead to full system compromise.

Exploitability

Exploitation is moderately difficult as it requires an attacker to upload or provide a crafted archive file with maliciously formatted filename containing cmd.exe metacharacters, but the vulnerability is remotely triggerable through standard archive processing workflows.

Blast radius

The impact could be significant across systems that process untrusted archives using patool, potentially allowing attackers to execute arbitrary commands with the privileges of the patool process, which may include system-level access.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to patool version 4.0.6 or later to fix the OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.