CVE-2026-120320 jxxghp CVE debrief

Who should care

Defenders responsible for MoviePilot deployments, security teams, and vulnerability management teams should assess exposure and prioritize remediation. This involves verifying the presence of affected versions, assessing the feasibility of deserialization attacks, and planning for upgrades or mitigations. Security teams should also review monitoring and detection capabilities for exposed assets.

Why it matters

CVE-2026-120320 vulnerability in jxxghp MoviePilot up to 3.1.2 allows for deserialization attacks via the WorkflowExecutor.restore_context function. Defenders should prioritize verifying exposure and assessing attack feasibility. Remediation involves upgrading to version 3.1.3.

• Verify exposure of MoviePilot versions up to 3.1.2
• Assess feasibility of deserialization attacks
• Prioritize upgrading to version 3.1.3

Technical summary

The vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py in jxxghp MoviePilot up to 3.1.2. It allows for deserialization attacks that can be launched remotely, leveraging the Workflow Fork Endpoint. Defenders should prioritize verifying exposure and assessing attack feasibility. Remediation involves upgrading to version 3.1.3 or applying the patch 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. Limited source detail suggests focusing on defensive verification tasks rather than unsupported vulnerability claims.

Defensive priority

Defenders should prioritize verifying exposure of MoviePilot versions up to 3.1.2 and assessing the feasibility of deserialization attacks. Remediation involves upgrading to version 3.1.3.

Recommended defensive actions

• Verify exposure of MoviePilot versions up to 3.1.2
• Assess the feasibility of deserialization attacks
• Upgrade to version 3.1.3
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm patch application and monitor for suspicious activity

Evidence notes

The vulnerability was publicly disclosed and affects MoviePilot up to version 3.1.2. The attack can be launched remotely and involves deserialization. Defenders should verify exposure and assess feasibility with explicit evidence limits. Upgrading to version 3.1.3 is recommended. Limited source detail suggests verifying patch application and monitoring for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.