OS Command Injection via GIT_PATH in pymedusa
Priority HIGH 73CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00815 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Medusa (pymedusa): 1.0.12
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Medusa (pymedusa) Fixed in 1.0.12
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28627
References
More pymedusa Medusa vulnerabilities
- TI-2023-27487 Blind SSRF in /home/testslack endpoint CVSS 3.1MEDIUM 5.3
- TI-2023-27486 Blind SSRF in `/home/testdiscord` endpoint CVSS 3.1MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences