CVE-2021-28927

The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.

• CWE-78

• https://github.com/libretro/RetroArch/blob/d3dc3ee989ec6a4903c689907ffc47027f71f776/frontend/drivers/platform_win32.cPatch, Third Party Advisory
• https://labs.bishopfox.com/advisories/retroarch-for-windows-version-1.9.0Exploit, Third Party Advisory
• https://github.com/libretro/RetroArch/blob/d3dc3ee989ec6a4903c689907ffc47027f71f776/frontend/drivers/platform_win32.cPatch, Third Party Advisory
• https://labs.bishopfox.com/advisories/retroarch-for-windows-version-1.9.0Exploit, Third Party Advisory

Published

Apr 7, 2021

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28912BAB TECHNOLOGIE GmbH eibPort V3. Each device has its own uni…7.2
• CVE-2021-28913BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow un…9.8
• CVE-2021-28914BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow th…6.5
• CVE-2021-28918Improper input validation of octal strings in netmask npm pa…9.1
• CVE-2021-28924Self Authenticated XSS in Nagios Network Analyzer before 2.4…6.1
• CVE-2021-28925SQL injection vulnerability in Nagios Network Analyzer befor…9.8
• CVE-2021-28931Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows…8.8
• CVE-2021-28935CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via …5.4
• CVE-2021-28936The Acexy Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) Web …7.5
• CVE-2021-28937The /password.html page of the Web management interface of t…7.5
• CVE-2021-28938Siren Federate before 6.8.14-10.3.9, 6.9.x through 7.6.x bef…4.3
• CVE-2021-28940Because of a incorrect escaped exec command in MagpieRSS in …9.8