EUVD-2026-100771
GHSA-2m98-3p37-f6h9
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated, low-complexity exploitation with full confidentiality, integrity and availability impact - the classic profile of a critical OS command injection (CWE-78) in a web backend. However, several real-world risk signals are MISSING: no EPSS score, no CISA KEV listing, and no public proof-of-concept were provided. The only reference is the upstream fix commit itself, not exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The CVSS PR:N (unauthenticated) rating is INFERRED-consistent with the fix, which retrofits @login_required decorators onto numerous previously-unauthenticated endpoints (batch, commit, export_to_folder, integrations), implying attacker-reachable endpoints existed without auth. One important caveat: the visible portion of the fix commit shows authentication hardening and secret-key generation, NOT an obvious command-neutralization/shell-escaping change - the actual command-injection sink fix is either in a truncated part of the diff or is addressed indirectly by gating endpoints behind authentication; this should be verified against the full commit. Net: the severity rating is credible for a command-injection flaw, but the absence of EPSS/KEV/POC and the niche footprint of QA-Board suggest this is a genuinely high-severity bug with currently LOW evidence of active or widespread exploitation - prioritize patching for anyone running QA-Board, but it is not a mass-exploitation emergency on the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
OS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operating-system commands on the host running the service, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The flaw, classified as CWE-78, affects all versions matched by the wildcard CPE cpe:2.3:a:samsung_open_source:qa-board:*:*:*:*:*:*:*:*, so no release line is known to be exempt. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, but the trivial remote/unauthenticated attack profile makes rapid patching the priority.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed. Apply commit 05789e67c5d022f2403b9340fc8d82dc99dc3707 (https://github.com/Samsung/qaboard/commit/05789e67c5d022f2403b9340fc8d82dc99dc3707) or any later upstream revision, which adds the login_required decorator to the batch, commit, export_to_folder and integrations endpoints and closes the null-user authentication bypass in get_current_user. Until an independently versioned release that includes that commit can be confirmed and deployed, use these compensating controls: set a strong, unique SECRET_KEY environment variable so the hardcoded default 'please-generate-your-own-secret-key' cannot be used to forge sessions and reach the command-invoking code paths (side effect: existing user sessions are invalidated on restart); set QABOARD_LOGIN_RESTRICTED so project-scoped requests are checked against the authenticated user rather than served to anyone (side effect: legitimate anonymous or cross-project read access stops working, so CI integrations must be given credentials); and block direct network access to the QA-Board backend from untrusted networks by placing it behind an authenticating reverse proxy or VPN allow-list and firewalling its service port (side effect: external CI runners and webhooks must be re-pointed or explicitly allow-listed). None of these controls eliminate the underlying shell-injection flaw, so treat them as temporary mitigations rather than a substitute for the upstream patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QA-Board is Samsung's open-source tool for tracking, comparing and visualizing CI/QA test results across projects and batches; its backend is a Python/Flask service that schedules and runs comparison jobs and integrates with code-hosting servers such as GitLab. The vulnerability class is CWE-78, improper neutralization of special elements used in an OS command, meaning user-controllable input reaches a shell invocation (for example subprocess/os.system-style calls used to launch batch or export jobs) without correct quoting or argument separation, letting an attacker append their own commands. The public fix commit 05789e67c5d022f2403b9340fc8d82dc99dc3707 is consistent with this class: it introduces a login_required decorator that is applied to the batch, commit, export_to_folder and integrations API endpoints (previously reachable without a session), fixes a null-user handling bug in get_current_user, and replaces the hardcoded default Flask SECRET_KEY ('please-generate-your-own-secret-key') with a lazily generated per-instance key so sessions cannot be forged by anyone who knows the default. Because the CVSS vector is PR:N, the vulnerable command-invoking paths were reachable without authentication, which is why the single fix commit couples authorization hardening with session-secret hardening.
Know when Samsung Open Source gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (samsung.tv_appliance) · only source for this CVE.
CVSS VectorVendor: samsung.tv_appliance
DescriptionCVE.org
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.
Executive ViewAI
Samsung QA-Board, an open-source quality-assurance tooling component, contains a critical command-injection flaw that lets an unauthenticated attacker on the network run arbitrary operating-system commands on any server hosting it, resulting in complete loss of confidentiality, integrity and availability on that host. Because the defect affects every release line and no vendor fix exists, any internet- or partner-reachable deployment remains exposed indefinitely, and a compromised host can serve as a foothold for lateral movement into build, source-code and CI/CD environments. Leadership should treat QA-Board instances as unprotectable until patched and decide quickly whether they must be isolated or retired.
No vendor patch identified at time of analysis. Interim mitigations: remove all network exposure by firewalling or isolating QA-Board hosts, disable or decommission instances that cannot be segmented, run the service as an unprivileged account or restricted container with egress filtering and shell execution blocked, apply application allowlisting and file-integrity monitoring, and enable and monitor process-spawn and outbound-connection logging for signs of command injection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
More in Samsung Open Source
View allHeap buffer overflow in Samsung's rlottie animation rendering library allows remote denial-of-service via maliciously cr
Uncontrolled resource consumption in Samsung's open-source rlottie library allows a crafted Lottie animation file to tri
Out-of-bounds write in Samsung's Escargot lightweight JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3
Heap-based buffer overflow in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d3) all
Use-after-free memory corruption in Samsung's Escargot JavaScript engine (commit 590345cc6258317c5da850d846ce6baaf2afc2d
Out-of-bounds write in Samsung's Escargot JavaScript engine allows attacker-supplied scripts to corrupt memory through t
Integer overflow in Samsung Escargot JavaScript engine allows remote attackers to trigger buffer overflows without authe
NULL pointer dereference in Samsung's open-source Walrus WebAssembly runtime crashes the parser when processing malforme
NULL pointer dereference in Samsung Open Source Walrus's WebAssembly binary parser causes application-level denial of se
Uncontrolled recursion in Samsung's Escargot JavaScript engine triggers excessive heap allocation, causing a denial-of-s
Denial of service in Samsung Escargot JavaScript engine at commit 590345cc6258317c5da850d846ce6baaf2afc2d3 stems from mu
Denial-of-service in Samsung's Escargot JavaScript engine (commit 590345cc) stems from multiple unhandled exceptional co
Exploit-DB