ClipBucket’s Remote Play feature permitted any authenticated user to import an external video URL, concatenating that URL directly into shell commands without escaping. An attacker can inject shell metacharacters in the URL, causing arbitrary shell commands to run with the privileges of the web application. This flaw allows full remote code execution on the host, a classic process‑control vulnerability identified as CWE‑78.

Any deployment of MacWarrior’s ClipBucket v5 that is running any version prior to 5.5.3 – #140 is affected. The patch added in 5.5.3 resolves the command‑injection issue.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. No EPSS data is available, so the likelihood of exploitation cannot be quantified here, but the defect exists in the web interface and can be triggered by any authenticated user. It is not listed in CISA’s KEV catalog. An attacker must first authenticate to the application (or obtain credentials) and then supply a crafted URL via the Remote Play interface. Once activated, the attacker can execute arbitrary commands on the server, compromising confidentiality, integrity, and availability of the entire system.