CVE-2026-120320

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.

• CWE-20
• CWE-502

• https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md
• https://github.com/jxxghp/MoviePilot/
• https://github.com/jxxghp/MoviePilot/commit/6034dcc880c13079aeb398dbe32c346ebcd3a6d2
• https://github.com/jxxghp/MoviePilot/pull/6930
• https://github.com/jxxghp/MoviePilot/releases/tag/v3.1.3
• https://vuldb.com/cve/CVE-2026-120320
• https://vuldb.com/submit/1015025
• https://vuldb.com/vuln/429653
• https://vuldb.com/vuln/429653/cti

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120315LobeHub Chat from 1.84.26 before 2.1.49 contains a path trav…8.8
• CVE-2026-120316http4k before 6.62.0.0-ee contains a path traversal vulnerab…5.9
• CVE-2026-120317http4k from 4.9.10.0 before 6.60.0.0 contains a missing inte…5.9
• CVE-2026-120318Product Gallery Slider & Additional Variation Images for Woo…7.2
• CVE-2026-120319A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. …6.3
• CVE-2026-12032Inappropriate implementation in Passwords in Google Chrome o…3.1
• CVE-2026-120322A vulnerability was identified in Termix-SSH Termix up to 2.…9.9
• CVE-2026-120323A security flaw has been discovered in samanhappy MCPHub up …4.3
• CVE-2026-120324A weakness has been identified in Aklivity Zilla up to 1.3.4…8.3
• CVE-2026-120325A security vulnerability has been detected in Webpro-nl Knip…6.3
• CVE-2026-120327The click tracking middleware accepts an arbitrary target UR…5.3
• CVE-2026-120328The click tracking middleware does not validate the authenti…6.9