# CVE-2026-120320: jxxghp MoviePilot unsafe deserialization in workflow fork

Source: https://junglewise.ai/threats/cve-2026-120320-a-vulnerability-was-determined-in-jxxghp-moviepilot-up-to-3-1-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120320 · Severity: medium · CVSS 4.7 · Published 2026-11-02

MoviePilot is a NAS media library automation tool. An authenticated user with manage permission can craft a malicious workflow and trigger remote code execution through unsafe deserialization of pickle objects, potentially compromising the entire system running MoviePilot.

Technologies: [Jxxghp MoviePilot](https://junglewise.ai/threats/technologies/moviepilot). Vendors: [Jxxghp](https://junglewise.ai/threats/vendors/jxxghp).

## Quick answers

**Is CVE-2026-120320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120320 being exploited in the wild.

**How severe is CVE-2026-120320?** Medium severity, with a CVSS score of 4.7, published 2 November 2026.

**Which products and versions are affected?** Jxxghp MoviePilot up to 3.1.2.

**Is there a fix for CVE-2026-120320?** Yes: fixed in 3.1.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120320 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-120320?** Check whether you run Jxxghp MoviePilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.1.3

## Technical details

The WorkflowExecutor.restore_context() method in app/chain/workflow.py unsafely deserializes user-controlled pickle data from the workflow.context database column without signature verification or type allowlisting. An authenticated user can exploit the POST /api/v1/workflow/fork endpoint to inject a crafted base64-encoded pickle payload via the context field, which is then deserialized via pickle.loads() when the workflow is executed, allowing arbitrary code execution with service process privileges.

## Affected products

- jxxghp MoviePilot up to 3.1.2

## Timeline

- 2026-11-02: disclosed

## References

- [https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md](https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md)
- [https://github.com/jxxghp/MoviePilot/](https://github.com/jxxghp/MoviePilot/)

## Related threats

- [MoviePilot command injection via prompt injection in execute_command](https://junglewise.ai/threats/cve-2026-77931-moviepilot-through-3-1-5-contains-a-command-injection)
- [jxxghp MoviePilot improper authorization in Application API](https://junglewise.ai/threats/cve-2026-16224-jxxghp-moviepilot-improper-authorization-in-application-api)
- [jxxghp MoviePilot path traversal in cloud storage download handlers](https://junglewise.ai/threats/cve-2026-11416-jxxghp-moviepilot-path-traversal-in-cloud-storage-download)
- [jxxghp MoviePilot SSRF in image proxy endpoint](https://junglewise.ai/threats/cve-2026-10107-jxxghp-moviepilot-ssrf-in-image-proxy-endpoint)