XMMS.pm in X2 XMMS Remote as obtained from the vendor server between 4 AM 11 AM PST on May 7 2003 allows remote attackers to execute arbitrary commands via shell metacharacters in a request to TCP port 8086.