patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execute commands with patool process privileges.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
wummel:patool
References 4
https://github.com/wummel/patool/commit/592f35761f428afbcde2888ecd3cc4af43881aeb
Patch Commit
https://github.com/wummel/patool
NVD
https://github.com/wummel/patool/blob/4.0.5/patoolib/util.py#L110-L116
NVD
https://www.vulncheck.com/advisories/patool-before-4.0.6-os-command-injection-o…
VulnCheck Advisory: patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt