CVE-2026-25933

Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in the Terminal component of the arduino-app-lab application. The issue stems from insufficient sanitization and validation of input data received from connected hardware devices, specifically in the _info.Serial and _info.Address metadata fields. The problem occurs during device information handling. When a board is connected, the application collects identifying attributes to establish a terminal session. Because strict validation is not enforced for the Serial and Address parameters, an attacker with control over the connected hardware can supply specially crafted strings containing shell metacharacters. The exploitation requires direct physical access to a previously tampered board. When the host system processes these fields, any injected payload is executed with the privileges of the user running arduino-app-lab. This vulnerability is fixed in 0.4.0.

• CWE-78

• https://github.com/arduino/arduino-app-lab/releases/tag/al-0.4.0Product, Release Notes
• https://github.com/arduino/arduino-app-lab/security/advisories/GHSA-3652-939f-f7g4Patch, Vendor Advisory

Published

Feb 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25928OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25929OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-2593The Greenshift – animation and page builder blocks plugin fo…6.4
• CVE-2026-25930OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25931vscode-spell-checker is a basic spell checker that works wel…7.8
• CVE-2026-25932GLPI is a Free Asset and IT Management Software package. Fro…4.8
• CVE-2026-25934go-git is a highly extensible git implementation library wri…4.3
• CVE-2026-25935Vikunja is a todo-app to organize your life. Prior to 1.1.0,…5.4
• CVE-2026-25936GLPI is a free Asset and IT management software package. Sta…8.8
• CVE-2026-25937GLPI is a free Asset and IT management software package. Sta…6.5
• CVE-2026-25938FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.8
• CVE-2026-25939FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.1