Researchers disclosed a high-severity vulnerability (CVE-2026-77931) in MoviePilot, an open-source media-library management tool with an integrated AI assistant. Instructions hidden in content the assistant reads—such as a web page fetched during normal operation—can trigger an always-available execute_command tool, allowing an attacker to run operating-system commands using the administrator’s session via indirect prompt injection. The flaw was rated CVSS 8.7 with high impact to confidentiality, integrity, and availability. No exploitation in the wild has been reported.