radare2 CVE-2026-112077

Exploitation requires the radare2 HTTP server (=h or background =h&) to be explicitly started and bound to an interface reachable by an untrusted party; it is not running by default. The operator must be relying on http.sandbox=true for confinement, yet because cfg.sandbox.grain defaults to 'all', sandbox capabilities including exec are never actually revoked for /cmd commands, so the 'protection' can be bypassed to spawn processes. Limiting factors: the server is off by default (non-default deployment), http.auth is separate and disabled by default (the HTTP sandbox is explicitly not authentication), and the attack is rated high complexity/difficult. Patched in 6.2.4, which fixes the session sandbox policy to enforce restrictions per-thread independent of the local grain value.

This is a high-CVSS-context-but-low-real-risk issue in practice. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N, impacts VC:L/VI:L/VA:L, score 6.3) indicates a network-reachable flaw with no authentication but high attack complexity. Crucially, the CVSS vector's AC:H and the exploit-maturity field (E:X, meaning exploitation status is not defined) align with the maintainer's own account: this is a protection-mechanism-failure (CWE-693) sandbox-configuration weakness, not a default-reachable remote bug. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was supplied, so there is no signal of active or imminent widespread exploitation. The signals are therefore consistent rather than conflicting: a genuine but conditional weakness. Important nuance for prioritization - the maintainer explicitly states the report overstates severity: the r2 HTTP server defaults to http.sandbox=true, but cfg.sandbox.grain defaults to 'all', so process execution (exec) is never actually blocked for commands received via /cmd; the HTTP sandbox is also not authentication. The practical consequence when the endpoint IS reached by an untrusted party is arbitrary command execution, which is higher impact than the vendor's L/L/L rating implies - hence my independent assessment below rates impact higher while keeping AC:H to reflect the non-default exposure requirement. Net: low real-world priority for most users because the vulnerable server is off by default, but high impact for anyone who exposes the r2 HTTP server to untrusted networks.

An analyst starts radare2's HTTP server (=h / =h&) and binds it to a network-reachable interface without http.auth, trusting that the default http.sandbox=true will confine remote commands. An attacker who can reach the /cmd endpoint submits a command that spawns a process, because cfg.sandbox.grain defaults to 'all' and exec is never actually blocked, achieving arbitrary OS command execution in the r2 user's context. No public exploit identified at time of analysis, and the attack is rated high complexity because it depends on this non-default, exposed deployment.