CVE-2026-106057: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in wummel patool

CVE-2026-106057 is an OS command injection vulnerability in patool prior to version 4.0.6 on Windows. The vulnerability arises because the shell_quote_nt function fails to properly escape cmd.exe metacharacters and embedded double quotes in archive filenames. As a result, attackers can supply specially crafted filenames (e.g., containing characters like '&') that, when processed by patool with shell=True for single-file formats, lead to execution of arbitrary commands with the same privileges as the patool process.

Successful exploitation allows an attacker to execute arbitrary OS commands on the affected Windows system with the privileges of the patool process. This can lead to unauthorized command execution, potentially compromising system integrity and confidentiality.

Upgrade patool to version 4.0.6 or later, where this vulnerability is fixed. Patch status is confirmed by the version boundary indicating versions before 4.0.6 are affected. No vendor advisory content is provided, so check the vendor's official channels for the patch. Until patched, avoid processing untrusted archive filenames with patool on Windows, especially when shell=True is used.