reNgine CVE-2026-105487

Requires an authenticated low-privileged account on the reNgine web application (PR:L) with the ability to create or modify scan targets through the listTargets endpoint (ListTargetsDatatableViewSet). The injected payload must be placed in the target Name argument, which is passed to an OS command when the subdomain_discovery task executes - so exploitation only fires once a subdomain discovery scan is run against the crafted target. Limiting factors: valid authentication is mandatory (not exploitable pre-auth), the endpoint was writable only before the fix, and the product is a specialized reconnaissance tool rather than ubiquitous infrastructure. Affected versions are reNgine up to and including 2.2.0.

Signals conflict sharply and must be weighed carefully. VulDB assigned a CVSS 4.0 base score of only 2.1 using VC:L/VI:L/VA:L, but the flaw is CWE-78 OS command injection (confirmed by description and by the PR diff tightening the listTargets endpoint from a writable ModelViewSet to ReadOnlyModelViewSet) - command injection normally yields full server-side code execution, so the Low/Low/Low impact rating appears to understate true technical impact; a more realistic rating is High across C/I/A. On exploitation signals: KEV status is NOT present, so there is no evidence of active exploitation; however, a public exploit (VulDB issue reference) exists and the CVSS carries E:P (proof-of-concept). No EPSS score was provided. The CVSS vector is AV:N/PR:L, meaning network-reachable but requiring an authenticated low-privileged account, which meaningfully constrains the attacker population to users who already have reNgine login access. Net: this is a credible post-authentication RCE in a security tool, not a mass-exploitation internet threat - priority should be driven by the RCE impact and exploit availability, tempered by the authentication requirement and the niche deployment footprint. The vendor's own low score should be treated as likely inaccurate and verified independently.

An authenticated low-privileged reNgine user (or an attacker who has obtained any valid account) creates or edits a scan target and embeds shell metacharacters in the target Name field. When the subdomain_discovery task in web/reNgine/tasks.py runs, the Name is passed unsanitized into an OS command, executing attacker-controlled commands on the reNgine host or worker. A public proof-of-concept exists, lowering the effort required.