CVE-2026-107202
Last modified
CVE-2026-107202 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root.
Description
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the application constructs nftables/iptables rule strings using fmt.Sprintf and executes them via bash -c as root. Because the listen field lacks port or format validation, arbitrary OS commands can be injected and executed with root privileges.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| jonssonyan | h-ui | 0.0.25 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-107202?
How severe is CVE-2026-107202?
How do I fix CVE-2026-107202?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-107181Telegram Desktop before 7.2.9 contains an IPC record-separat…8.1
- CVE-2026-107183llama.cpp before b11393 contains a use-after-free and double…8.1
- CVE-2026-10719Out of bounds write in openSeaChest’s --showSupportedFormats…1.8
- CVE-2026-107194Sungrow iSolarCloud before 2026 allows authentication bypass…9.2
- CVE-2026-1072The Keybase.io Verification plugin for WordPress is vulnerab…4.3
- CVE-2026-10720Canonical MicroCeph versions from the squid and tentacle tra…5.1
- CVE-2026-107204LMCache through 0.5.5 contains an unauthenticated remote cod…9.8
- CVE-2026-107205LMCache through 0.5.5 contains a missing authentication vuln…8.6
- CVE-2026-107206LMCache through 0.5.5 contains a missing authentication vuln…9.4
- CVE-2026-107207LMCache through 0.5.5 contains a server-side request forgery…7.2
- CVE-2026-107208ImageMagick is free and open-source software used for editin…5.3
- CVE-2026-107209ImageMagick is free and open-source software used for editin…5.9
Are you affected by CVE-2026-107202?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST