What’s Vulnerable › Vulnerabilities

CVE-2023-28627: OS Command Injection via GIT_PATH in pymedusa

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-27 · updated 2026-06-17
• Weakness: CWE-78

Description

pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• pymedusa Medusa: before 1.0.12 — fixed in 1.0.12

How to fix

Upgrade to a fixed version: pymedusa Medusa 1.0.12. Check the vendor advisory for mitigations.

References

• https://github.com/pymedusa/Medusa/commit/66d4be8f0872bd5ddcdc5c5a58cb014d22834a45
• https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9
• https://github.com/pymedusa/Medusa/commit/66d4be8f0872bd5ddcdc5c5a58cb014d22834a45
• https://github.com/pymedusa/Medusa/security/advisories/GHSA-6589-x6f5-cgg9

Get alerted when CVE-2023-28627 or the next vulnerability affects your stack