CVE-2026-42846: ClipBucket: Remote Play URL Command Injection

Synopsis

Command injection in ClipBucket v5's Remote Play URL import feature allows any network-accessible attacker to execute arbitrary shell commands on the server. The flaw stems from user-supplied URLs being concatenated directly into shell commands without escaping or sanitization, so any shell metacharacter in a crafted URL is interpreted by the shell. Successful exploitation gives an attacker full command execution on the host, enabling complete confidentiality, integrity, and availability compromise. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Remote Play endpoint is exposed over the network, so an attacker must be able to reach the ClipBucket service via HTTP/HTTPS.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no credentials or prior account access are required to trigger the injection.

• Victim interactionNot required

  The CVSS vector specifies UI:N; exploitation is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free; no race conditions, special memory layout, or environmental factors need to align.

Blast Radius

• Attacker executes arbitrary shell commands on the server hosting ClipBucket, gaining the same OS-level privileges as the web application process.
• All data accessible to that process, including stored video metadata, user records, and session tokens, is readable by the attacker.
• The attacker can write, overwrite, or delete files on the server, modifying application code, configuration, or stored media.
• The attacker can crash or resource-exhaust the service, taking the video platform offline for all users.