CVE-2026-5208CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold

High · published April 8, 2026

CVSS v3.1
8.2
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

Command injection in alerts in CoolerControl/coolercontrold <4.0.0 allows authenticated attackers to execute arbitrary code as root via injected bash commands in alert names

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01501 · 74.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-08T11:36Z
EPSS history
Timeline
  • 08 APR 11:36Z
    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in coolercontrold
    cvelistv5