CVE-2026-105487CWE-77CWE-78command-injection

CVE-2026-105487

Medium · published October 6, 2026

CVSS v3.1
6.3
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.01089 · 65.1th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-06T06:17Z
References (7)
https://github.com/yogeshojha/rengine/ · [email protected]https://github.com/yogeshojha/rengine/issues/1561 · [email protected]https://github.com/yogeshojha/rengine/pull/1562 · [email protected]https://vuldb.com/cve/CVE-2026-105487 · [email protected]https://vuldb.com/submit/986584 · [email protected]https://vuldb.com/vuln/413623 · [email protected]https://vuldb.com/vuln/413623/cti · [email protected]
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 1%
    epss
  • 06 OCT 01:45Z
    yogeshojha reNgine listTargets Endpoint tasks.py subdomain_discovery os command injection
    cvelistv5