{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2026-96654",
  "revision": 1,
  "title": "Plex Media Server — searchOne Plugin Function Calls",
  "summary": "Plex Media Server before 1.43.3.10861 does not clean link values passed to searchOne, so an attacker can call other plugins' functions with parameters of their choosing. It can be chained with three other Plex flaws.",
  "source_type": "cve",
  "severity": "medium",
  "cvss": {
    "score": 6.9,
    "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
    "version": "4.0"
  },
  "epss": 0.01949,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": false,
    "attack_complexity": "low",
    "kev_added": "2026-10-20",
    "kev_due": "2026-10-23",
    "prerequisites": "Network access to the Plex Media Server."
  },
  "remediation": {
    "patch_available": true,
    "fixed_in": [
      "1.43.3.10861"
    ]
  },
  "recommended_action": "Update Plex Media Server to 1.43.3.10861 or later.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-96654",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2026-96654",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2026-96654",
      "retrieved_at": "2026-11-05T07:48:47.009Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96654",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "writeup",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json"
    },
    {
      "type": "writeup",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96654"
    },
    {
      "type": "writeup",
      "url": "https://zmain.info/blog/plex2shell"
    }
  ],
  "published_at": "2026-09-23T17:17:23.517Z",
  "issued_at": "2026-11-05T07:48:47.009Z",
  "tags": [
    "plex",
    "input-validation"
  ]
}