A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/jxxghp/MoviePilot/pull/6930 issue-tracking, patch
- https://github.com/jxxghp/MoviePilot/commit/6034dcc880c13079aeb398dbe32c346ebcd3a6d2 patch
- https://github.com/jxxghp/MoviePilot/releases/tag/v3.1.3 patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.1 · jxxghpNVD modified 2026-11-02 01:30
Affected (CPE criteria) 1
cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:*
References 9
- https://vuldb.com/vuln/429653 vdb-entry, technical-description
- https://vuldb.com/vuln/429653/cti signature, permissions-required
- https://vuldb.com/cve/CVE-2026-120320 third-party-advisory
- https://vuldb.com/submit/1015025 third-party-advisory
- https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md exploit
- https://github.com/jxxghp/MoviePilot/pull/6930 issue-tracking, patch
- https://github.com/jxxghp/MoviePilot/commit/6034dcc880c13079aeb398dbe32c346ebcd3a6d2 patch
- https://github.com/jxxghp/MoviePilot/releases/tag/v3.1.3 patch
- https://github.com/jxxghp/MoviePilot/ product