Quick answers
- Is CVE-2026-42846 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42846 being exploited in the wild.
- How severe is CVE-2026-42846?
- Critical severity, with a CVSS score of 9.8, published 11 June 2026.
- Which products and versions are affected?
- MacWarrior ClipBucket <= 5.5.3 - #139.
- Is there a fix for CVE-2026-42846?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-42846 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-42846?
- Check whether you run MacWarrior ClipBucket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An OS command injection vulnerability exists in ClipBucket v5 (prior to version 5.5.3 - #140) within the Remote Play functionality. The application accepts a user-provided URL via the 'remote_play_url' parameter and passes it to shell commands (such as ffprobe and mediainfo) using string concatenation without proper escaping. Because the input is executed via shell_exec(), an attacker can include shell metacharacters (e.g., $(...)) in the URL to achieve arbitrary code execution. While the application performs some URL validation and SSRF checks, it fails to neutralize characters that trigger command execution. This allows an authenticated attacker (including self-registered users) to gain full control over the underlying server. The issue is patched in version 5.5.3 - #140.
Affected products
- MacWarrior ClipBucket <= 5.5.3 - #139
Timeline
- 2026-05-27: advisory: Vendor advisory published on GitHub
- 2026-06-11: disclosed: CVE published to NVD