High · published December 11, 2025
⚡ A sneaky command injection vulnerability lets local users execute arbitrary commands as root in Windscribe for Linux! 😱 Think of it like a maintenance worker who has a key to the server room but can also access the CEO's office if nobody checks who’s using it. This is what happens here; a local user with certain permissions can sneak in and take charge! An attacker could gain root access and execute any command they desire, potentially leading to complete system compromise. This means they could modify settings, access sensitive data, or even mess up critical configurations — an absolute nightmare for security!
Think of it like a maintenance worker who has a key to the server room but can also access the CEO's office if nobody checks who’s using it. This is what happens here; a local user with certain permissions can sneak in and take charge! This vulnerability arises from improper validation of the 'adapterName' parameter in the 'changeMTU' function, allowing a local user in the windscribe group to inject malicious commands that run with root privileges.
An attacker could gain root access and execute any command they desire, potentially leading to complete system compromise. This means they could modify settings, access sensitive data, or even mess up critical configurations — an absolute nightmare for security! Upgrade to Windscribe version 2.18.3-alpha or 2.18.8 immediately to close this loophole. Additionally, review group permissions to ensure no unnecessary access is granted to local users. 🔒 You've got this! Following these steps will help you secure your app in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| windscribe/windscribe | ≥ 2.10.1, ≤ 2.17.10 | — |
| windscribe/windscribe | all versions | — |
| windscribe/windscribe | all versions | — |
| windscribe/windscribe | all versions | — |