EUVD-2026-34965
GHSA-cx7v-5xwm-4mqw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in vertex-app vertex up to 2026.02.12. This issue affects some unknown processing of the file app/model/LogMod.js of the component Log Viewer Endpoint. Such manipulation of the argument req.query leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The name of the patch is 805d82e7100d49b79b3beb1b9420e8e458987198. It is best practice to apply a patch to resolve this issue.
AnalysisAI
OS command injection in vertex-app vertex (all versions through 2026.02.12) allows remote low-privileged authenticated users to execute arbitrary operating system commands via the Log Viewer Endpoint. The root cause is direct interpolation of the user-controlled req.query.type parameter into a shell-executed execSync() call in app/model/LogMod.js, enabling shell metacharacter injection without any sanitization or allowlist validation. A publicly available proof-of-concept exists on GitHub Gist and Google Drive; no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), but the CVSS temporal score includes E:P (proof-of-concept) and RC:C (confirmed), elevating real-world urgency.
Technical ContextAI
The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The affected component is the Node.js module app/model/LogMod.js, which handles the Log Viewer Endpoint. The vulnerable code constructs a shell command via template literal interpolation: execSync('tail -n 2000 ' + logFile) where logFile is derived from the user-supplied req.query.type parameter. Because Node.js child_process.execSync() invokes /bin/sh -c under the hood, any shell metacharacters (e.g., ;, $(), |) present in the type value are interpreted by the shell, enabling arbitrary command execution. The patch (commit 805d82e7) corrects this by replacing execSync with spawnSync, which passes arguments as an array without invoking a shell, and adds a strict allowlist of permitted log type values: ['error', 'info', 'debug', 'watch', 'watchdebug', 'binge', 'bingedebug', 'advanceddebug', 'advanced', 'scdebug', 'sc']. The same commit also addresses a secondary injection in TorrentMod.js and adds sameSite: 'lax' to cookie settings. Affected products per CPE: cpe:2.3:a:vertex-app:vertex:*:*:*:*:*:*:*:*.
RemediationAI
Apply upstream patch commit 805d82e7100d49b79b3beb1b9420e8e458987198, available at https://github.com/vertex-app/vertex/commit/805d82e7100d49b79b3beb1b9420e8e458987198. Note that a formally tagged release version incorporating this fix is not independently confirmed from the available data - operators should verify whether a packaged release has been cut from this commit. As a compensating control where immediate patching is not feasible, restrict network access to the Log Viewer Endpoint via a reverse proxy or WAF rule blocking requests to the log viewer route, or enforce stricter role-based access controls so that only administrative roles can reach the endpoint - be aware this may limit legitimate log visibility for operations staff. Alternatively, manually patch LogMod.js by replacing the execSync call with spawnSync and adding the type allowlist as shown in the patch diff. Do not rely solely on input filtering without also migrating away from shell-based execution, as allowlist bypasses remain possible if the shell invocation is not eliminated.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today