Unauthenticated RCE via Socket.IO input handler in LazyOwn (CVE-2026-68502)

LazyOwn's C2 server (lazyc2.py) registers a Socket.IO `input` event handler on the default namespace with no authentication guard. An unauthenticated network attacker who can reach the C2 port can emit an `input` event whose payload is dispatched through `LazyOwnShell.one_cmd()` to `subprocess.call(command, shell=True)`, resulting in full remote code execution in the context of the C2 process. Affected versions: - <= 1.0.0 We recommend updating to: release/0.2.158. CVSS 9.8 · our assessment: act_now Reference: https://github.com/grisuno/LazyOwn/security/advisories/GHSA-fr84-8cfg-59w4 Details: https://vuln.today/cve/CVE-2026-68502