CVE-2023-28627: pymedusa medusa

csirt@kutim:~/threat-intel/cve/CVE-2023-28627

CVSS 8.8 · High EPSS 0,82%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada pymedusa medusa. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 27 Maret 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 0,82% peluang dieksploitasi; lebih tinggi dari 55,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pymedusa	medusa	Semua versi sebelum 1.0.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9 exploit · advisory vendor
https://github.com/pymedusa/Medusa/commit/66d4be8f0872bd5ddcdc5c5a58cb014d22834a45 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.