Mmastodon TechnologyCybersecurity first seen 11 d ago, last 11 d ago, peak #11

New ExifTool vulnerability CVE-2026-42589 allows remote code execution

Original: New. "The vulnerability, CVE-2026-42589, allows an attacker to inject ExifTool arguments through unsanitized metadata ke

A newly disclosed vulnerability, CVE-2026-42589, affects ExifTool, the widely used tool for reading image metadata. Attackers can inject ExifTool arguments through unsanitized metadata keys — inserting newlines into a JSON key lets them inject the -if argument and execute arbitrary Perl code. The flaw carries a high CVSS score, prompting warnings for users to patch promptly.

Why now: Security researchers are warning that the flaw is new and could enable arbitrary code execution through common image files, so admins are rushing to patch.

ExifToolCVE-2026-42589

Open on mastodon →

Evidence

• New. "The vulnerability, CVE-2026-42589, allows an attacker to inject ExifTool arguments through unsanitized metadata keys. By inserting newlines into a JSON key, an attacker can inject the -if argument and execute arbitrary Perl code. The vulnerability carries a CVSS score of… · AAKL@infosec.exchange · 1

API: https://socialmediatrends-api.osmike.com/v1/trends/3770553